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Using this Manual 



This manual covers the following emulators as used with the PC 
Interface. 

■ HP 64756F 70136 emulator 

■ HP 64757F 70236 emulator 

■ HP 64757G 70236A emulator 

For the most part, the 70136, 70236 and 70236A emulators all operate 
the same way. Differences between the emulators are described where 
they exist. All of the 70136, 70236 and 70236A emulators will be 
referred to as the "70136 emulator" in this manual where they are alike. 
In the specific instances where 70236 or 70236A emulator differs from 
the 70136 emulator, it will be referred as the "70236 emulator" or 
"70236A emulator". 

This manual: 

■ Shows you how to use emulation commands by executing 
them on a sample program and describing their results. 

■ Shows you how to use the emulator in-circuit (connected to a 
target system). 

■ Shows you how to configure the emulator for your 

development needs. Topics include: restricting the emulator 
to real-time execution, selecting a target system clock source, 
and allowing the target system to insert wait states. 

This manual will not: 

■ Show you how to use every PC Interface command and 
option. The PC Interface is described in the HP 64700 
Emulator's PC Interface: User's Reference. 



Organization 

Chapter 1 



"Introduction"-This chapter lists the 70136 emulator features and 
describes how they can help you in developing new hardware and 
software. 



Chapter 2 



Chapter 3 



Chapter 4 



Chapter 5 



Appendix A. 



"Getting Started"-This chapter shows you how to use emulation 
commands by executing them on a sample program. This chapter 
describes the sample program and how to: 

■ load programs into the emulator 

■ map memory 

■ display and modify memory 

■ display registers 

■ step through programs 

■ run programs 

■ set software breakpoints 

■ search memory for data 

■ use the analyzer 

"In-Circuit Emulation"-This chapter shows you how to plug the 
emulator into a target system, and how to use the "in-circuit" emulation 
features. 



"Configuring the Emulator"- You can configure the emulator to 
adapt it to your specific development needs. This chapter describes the 
emulator configuration options and how to save and restore particular 
configurations. 

"Using tlie Emulator"-This chapter describes emulation topics that 

are not covered in the "Getting Started" chapter (for example, 
coordinated measurements and storing memory). 

"File Format Reader"-This appendix describes how to use the File 
Format Reader from MS-DOS or PC Interface, load absolute files into 
the emulator, use global and local symbols with the PC Interface. 
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Introduction to the 70136 Emulator 

Introduction The topics in this chapter include: 

■ Purpose of the emulator 

■ Features of the emulator 

■ Limitations and Restrictions of the emulator 



Purpose of the The 70136 emulator is designed to replace the 70136 microprocessor in 

Emu IdtO r target system to help you debug/integrate target system software 

and hardware. The emulator performs just hke the processor which it 
replaces, but at the same time, it gives you information about the bus 
cycle operation of the processor. The emulator gives you control over 
target system execution and allows you to view or modify the contents 
of processor registers, target system memory, and I/O resources. 
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Figure 1-1. HP 64756/7 Emulator for uPD701 36/70236 
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Features of the This section introduces you to the features of the emulator. The 

701 36 Emu latOr chapters wWch follow show you how to use these features. 



Su pported The 701 36 emulator probe has a 68-pin PLCC connector. Also 
MicroprOCGSSOrS provided is the adapter, HP PART No. 64756-61612, that will allow 

the PLCC probe to connect to the NEC EV-9200G-74 socket which 
replaces the 74-pin QFP package of 70136 microprocessor. 

The HP 64756 emulator supports the following packages of 70136 
microprocessor. 

■ 68-pin PLCC 

■ 68-pin PGA 

(With using PLCC to PGA adapter; refer to the "In-Circuit 
Emulation Topics" chapter in this manual) 

■ 74-pin QFP 

(With using PLCC to QFP adapter (HP PART No. 
64756-61612) and NEC EV-9200G-74 socket) 

The 70236 and 70236A emulator probe has an 132-pin PGA connector. 
Also provided is the NEC EV-9500GD-120 adapter that will allow the 

PGA probe to connect to the NEC EV-9200GD-120 socket which 
replaces the 120-pin QFP package of 70236 microprocessor. 

The HP 64757 emulator supports the following packages of 70236 or 
70236A microprocessor. 

■ 132-pin PGA 

■ 120-pin QFP 

(With using NEC EV-9500GD-120 adapter and NEC 
EV-9200GD-120 socket) 
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Clock Speeds 



The 70136 emulator rans with an internal clock speed of 16 MHz 
(system clock), or with target system clocks from 2-16 MHz. 



The 70236 emulator rans with an internal clock speed of 16 MHz 
(system clock), or with target system clocks from 4-32 MHz. 

The 70236A emulator rans with an internal clock speed of 16 MHz 
(system clock), or with target system clocks from 4-40 MHz. 



Emulation memory The hp 70136 emulator is used with one of the following Emulation 

Memory Cards. 

■ HP 64726 128K byte Emulation Memory Card 

■ HP 64727 512Kbyte Emulation Memory Card 

■ HP 64728 IM byte Emulation Memory Card 

■ HP 64729 2M byte Emulation Memory Card 

You can define up to 16 memory ranges (at 256 byte boundaries and at 
least 256 byte in length). The monitor occupies 4K bytes leaving 
124K, 508K, 1020K or 2044K bytes of emulation memory which you 
may use. You can characterize memory ranges as emulation RAM, 
emulation ROM, target system RAM, target system ROM, or guarded 
memory. The emulator generates an error message when accesses are 
made to guarded memory locations. You can also configure the 
emulator so that writes to memory defined as ROM cause emulator 
execution to break out of target program execution. 



Analysis The hp 70136 emulator is used with one of the following analyzers 
which allows you to trace code execution and processor activity. 

■ HP 64704 80-charmel Emulation Bus Analyzer 

■ HP 64703 64-channel Emulation Bus Analyzer and 
16-channel State Timing Analyzer 

The HP 70236/70236A emulator is used with one of the following 
analyzers which allows you to trace code execution and processor 
activity. 

■ HP 64704 80-channel Emulation Bus Analyzer 

■ HP 64703 64-chaimel Emulation Bus Analyzer and 
1 6-channel State Timing Analyzer 

■ HP 64794A/C/D Deep Emulation Bus Analyzer 

When you use the HP 70236A emulator over 16MHz, you have to use 
the HP 64794 Deep Emulation Bus Analyzer. 
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Registers 
Single-Step 

Breakpoints 

Reset Support 

Configurable Target 
System Interface 



The Emulation Bus Analyzer monitors the emulation processor using 
an internal analysis bus. The HP 64703 64-channel Emulation Bus 
Analyzer and 16-channel State/Timing Analyzer allows you to probe 
up to 16 different lines in your target system. 

You can display or modify the 70136 internal register contents. 



You can direct the emulation processor to execute a single instruction 
or a specified number of instructions. 

You can set up the emulator/analyzer interaction so that when the 
analyzer finds a specific state, emulator execution will break to the 
background monitor. 

You can also define software breakpoints in your program. The 
emulator uses one of 70136 undefined opcode (Fl hex) as software 
breakpoint interrupt instruction. When you define a software 
breakpoint, the emulator places the breakpoint interrupt instruction (Fl 
hex) at the specified address; after the breakpoint interrupt instruction 
causes emulator execution to break out of your program, the emulator 
replaces the original opcode. 

The emulator can be reset from the emulation system under your 
control, or your target system can reset the emulation processor. 

You can configure the emulator so that it honors target system wait 
requests when accessing emulation memory. You can configure the 
emulator so that it presents cycles to, or hides cycles from, the target 
system when executing in background. 
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Foreg rOU nd or The emulation monitor is a program that is executed by the emulation 
Background processor, it allows the emulation controller to access target system 
Emulation Monitor resources. Forexample, when you display target system memory, it is 

the monitor program that executes 70136 instructions which read the 
target memory locations and send their contents to the emulation 
controller. 

The monitor program can execute in foreground, the mode in which 
the emulator operates as would the target processor. The foreground 
monitor occupies processor address space and executes as if it were 
part of the target program. 

The monitor program can also execute in background, the emulator 
mode in which foreground operation is suspended so that emulation 
processor can be used to access target system resources. The 
background monitor does not occupy any processor address space. 



Real-Time Operation Real-time operation signifies continuous execution of your program 

without interference from the emulator. (Such interference occurs when 
the emulator temporarily breaks to the monitor so that it can access 
register contents or target system memory or I/O.) 

You can restrict the emulator to real-time execution. When the 
emulator is executing your program under the real-time restriction, 
commands which display/modify registers, display/modify target 
system memory or I/O, or single-step are not allowed. 



Easy Products 
Upgrades 



Because the HP 64700 Series development tools (emulator, analyzer, 
LAN board) contain programmable parts, it is possible to reprogram 
the firmware and some of the hardware without disassembling the HP 
64700 A/B Card Cage. This means that you'll be able to update 
product firmware, if desired, without having to call an HP field 
representative to your site. 
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Limitations, 
Restrictions 

DMA Support in the 70136 Emulator, Direct memory access to the emulation 
memory by DMA controller is not permitted. 

In the 70236 and the 70236A Emulator, Direct memory access to the 
emulator by external DMA controller is not permitted. 



User Interrupts if you use the background monitor in the 70136 emulator, interrupts are 
suspended or ignored during background operation. NMl is suspended 
until the emulator goes into foreground operation. INT interrupt is 
ignored. 

If you use the background monitor in the 70236 and the 70236A 
emulator, interrupts from target system are suspended during 
background operation. NMI, and INTP0-INTP7 are suspended until 
the emulator goes into foreground operation. 



Interrupts While 
Executing Step 
Command 



While executing user program code in stepping in the foreground 
monitor, interrupts are accepted if they are enabled in the foreground 
monitor program. When using the foreground monitor you will see the 
following error message, if the interrupts are acknowledged before 
stepping user program code. 

ERROR: Stepping failed 

Although the error message above appears, the code is executed as you 
expected to do. 



Access i n g when you access intemal I/O registers of the emulator, you should use 
Internal I/O Registers the "display/modify register" command with their register name instead 

of the "display/modify io_port" command. 
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PC relative 
addressing 
in trace list 



When you use the following setting in your program, the branch 
address forming in PC relative addressing may change to a wrong 
value only in disassemble list. 



■ The program is running in the extended address mode. 

■ The effective address for the PC relative addressing is in the 
other page. 

■ The order of the pages is not in sequence in extended address. 



"BRKXA" and 
"RETXA" 

Instructions in 
Stepping 



When the "BRKXA" and "RETXA" instructions are executed in 
stepping, the emulator reads memory for disassembly after stepping. 
When you execute "BRKXA" instruction in stepping, the normal 
address where the "BRKXA" instruction is located is extended to read 
memory for disassemble after stepping. 

When you execute "RETXA" instruction in stepping, the normal 
address which is extended to point the "RETXA" instruction is not 
extended to read memory for disassemble after stepping. 



Stepping at Software 
Breal<point 



When you execute step commands in the foreground monitor, you 
should not step at the address which the "Software Breakpoint" was 
set; the stepping will be failed. 

ERROR: Stepping failed 



Evaluation Chip Hewlett-Packard makes no warranty of the problem caused by the 
70136/70236/70236A Evaluation chip in the emulator. 
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Getting Started 

Introduction This chapter leads you through a basic tutorial that shows how to use 

the 70136 emulator with the PC Interface. 

This chapter will: 

■ Tell you what to do before you use the emulator in the tutorial. 

■ Describe the sample program used for this chapter' s examples. 

■ Briefly describe how to enter PC Interface commands and 
how emulator status is displayed. 

This chapter wiU show you how to; 

■ Start up the PC Interface from the MS-DOS prompt. 

■ Define (map) emulation and target system memory. 

■ Load programs into emulation and target system memory. 

■ Enter emulation commands to view sample program execution. 
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Before You Begin 



Prerequisites Before be ginning the tutorial presented in this chapter, you must have 
completed the following tasks: 

1. Connected the emulator to your computer. The HP 64700 
Series Installation/Service manual shows you how to do this. 

2. Installed the PC Interface software on your computer. 
Software installation instructions are shipped with the media 
containing the PC Interface software. The HP 64700 
Emulators PC Interface: User's Reference manual contains 
additional information on the installation and setup of the PC 
Interface. 

3. In addition, it is recommended, although not required, that you 
read and understand the concepts of emulation presented in 
the Concepts of Emulation and Analysis manual. The 
Installation/Service also covers HP 64700 Series system 
architecture. A brief understanding of these concepts may 
help avoid questions later. 



The sample program The sample program used in this chapter is listed in figure 2-1. The 

program emulates a primitive command interpreter. 

programs;for getting started 

We will show you how to use the emulator to: 

■ load this program into emulation memory 

■ execute the program 

■ monitor the program' s operation with the analyzer 

■ simulate entry of different commands using the Memory 
Modify emulation command. 
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LOCATION OBJECT CODE LINE 



SOURCE LINE 



0000 
0000 
0005 
OOOA 

GOOF 
0012 
0017 
OOlC 
0021 
0024 
0029 
002E 
0033 
0036 



436F6D6D61 

6E64204120 

656E746572 

656420 

436F6D6D61 

6E64204220 

656E746572 

656420 

496E76616C 

696420436F 

6D6D616E64 

202020 



0000 B80000 

0003 8ED8 
0005 B80000 
0008 8EC0 
OOOA 8ED0 
OOOC BC00F9 



OOOF 26C6060000 
0014 0090 



0016 26A00000 
OOIA 3C00 
OOlC 74F8 



OOIE 3C41 

0020 7407 

0022 3C42 

0024 740C 

0026 E91200 



1 "70116" 

2 

3 

4 

5 Msgs 

6 Msg_A 



7 Msg_B 



Msg_I 



9 End_Msgs 



GLB 



Msgs , Init , Cmd_Input , Msg_Dest 



"Command A entered " 



DB 



"Command B entered " 



'Invalid Command 



10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 

27 
28 
29 
30 
31 
32 
33 
34 
35 
36 
37 
38 
39 
40 
41 
42 
43 
44 
45 



PROG 

ASSUME DSO :DATA, DSl :COMN 
****************************************************** 

* The following instructions initialize segment 

* regsiters and set up the stack pointer. 
****************************************************** 

Init MOV AW, SEG Msg_A 

MOV DSO, AW 

MOV AW, SEG Cmd_Input 

MOV DSl, AW 

MOV SS,AW 

MOV SP, OFFSET Stk 
****************************************************** 

* Clear previous command 

****************************************************** 
Rrad_Cmd 



MOV Cmd_I nput , # 0 



* Read command input byte. If no command has been 

* entered, continue to scan for command input. 
****************************************************** 

Scan MOV AL,Cmd_Input 

CMP AL, #0 

BE Scan 

****************************************************** 

* A command has been entered. Check if it is 

* command A, command B, or invalid. 

Exe_Cmd CMP AL,#41H 

BE Cmd_A 
CMP AL,#42H 
BE Cmd_B 
BR Cmd_I 

****************************************************** 

* Command A is entered. CW = the number of bytes in 

* message A. BP = location of the message. Jump to 



Figure 2-1 . Sample Program Listing 



Getting Started 2-3 



0029 B91200 
002C BEOOOO 
002F E90F00 



0032 B91200 
0035 BE0012 
0038 E90600 



003B B91200 
003E BE0024 



0041 BFOOOl 
0044 F3A4 



0046 C60500 
0049 47 
004A 81FF0021 
004E 75F6 



0050 EBBD 



0000 



0001 
00F9 



46 
47 
48 
49 
50 
51 
52 
53 
54 
55 
56 
57 
58 
59 
60 
61 
62 
63 
64 
65 
66 
67 
68 
69 
70 
71 
72 
73 
74 
75 
76 
77 
78 
79 
80 
81 
82 
83 
84 
85 
86 
87 



* the routine which writes the message. 
****************************************************** 

Cmd_A MOV CW, #Msg_B-Msg_A 

MOV IX, OFFSET Msg_A 

BR Write_Msg 
****************************************************** 

* Command B is entered. 



*r*****************il 



*r*************** 



Cmd 



MOV CW, #Msg_I-Msg_B 

MOV IX, OFFSET Msg_B 

BR Write_Msg 
****************************************************** 

* An invalid command is entered. 

****************************************************** 
Cmd_I MOV CW, #End_Msgs-Msg_I 

MOV IX, OFFSET Msg_I 

★★★*★★★★★★★★****************************************** 

* Message is written to the destination. 
****************************************************** 

Write_MSG MOV lY, OFFSET Msg_Dest 

REP MOVBKB 

****************************************************** 

* The rest of the destination area is filled 

* with zeros . 

****************************************************** 
Fill_Dest MOV BYTE PTR [IY],#0 

INC lY 

CMP lY, #Msg_Dest+20H 

BNE Fill_Dest 
****************************************************** 

* Go back and scan for next command 

****************************************************** 



BR 

COMN 



Read_Cmd 



* Command input byte . 

****************************************************** 
Cmd_Input DBS 1 

****************************************************** 

* Destination of the command message. 

****************************************************** 



Msg_Dest 
Stk 



<0000> 



90 



DDS 3EH 
DWS 1 
END Init 



Stack area. 



Figuer 2-1 . Sample Program Listing (Cont'd) 
Data Declarations 

The "DATA" section defines the messages used by the program to 
respond to various command inputs. These messages are labeled 
Msg_A, Msg_B, and Msg_I. 
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Initialization 



The program instructions from the Init label to the Read_Cmd label 
perform initialization. The segment registers are loaded and the stack 
pointer is set up. 

Reading Input 

The instruction at the Read_Cmd label clears any random data or 
previous commands from the Cmdjnput byte. The Scan loop 
continually reads the Cmdjnput byte to look for a command (a value 
other than 0 hex). 

Processing Commands 

When a command is entered, the instructions from Exe_Cmd to 
Cmd_A decide whether the command was "A", "B", or an invaUd 
command. 

If the command input byte is "A" (ASCII 41 hex), execution transfers 
to the instructions at Cmd_A. 

If the command input byte is "B" (ASCII 42 hex), execution transfers 
to the instructions at Cmd_B. 

If the command input byte is neither "A" nor "B", an invalid command 
was entered, and execution transfers to the instructions at Cmd_I. 

The instructions at Cmd_A, Cmd_B, and Cmd_I each load register 
CW with the displayed message's length and register IX with the 
message's starting location. Then, execution transfers to Write_Msg, 
which writes the appropriate message to the destination location, 
Msg_Dest. 

After the message is written, the instructions at Fill_Dest fill the 
remaining destination locations with zeros. (The entire destination area 
is 20 hex bytes long.) Then, the program jumps back to read the next 
command. 
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The Destination Area 



The "COMN" section declares memory storage for the coimnand input 
byte, the destination area, and the stack area. 

Assembling and The sample program is written for the HP 64853 Cross 
Linking the Sample Assembler/Linker. 

Program 

Use the following command to assemble and link the sample program. 

C> asm -oe cmd_rds . s > cmd_rds . o <RETURN> 

C> Ink -o > cand_rds.m <RETURN> 

object files cancl_rds.R <RETURN> 
library files <RETURN> 

Load addresses: PROG, DATA, COMN 400H, 600H, 800H <RETURN> 
more files (y or n) N <RETURN> 
absolute file name cmd_rds.X <RETURN> 
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starting Up the 
70136 PC Interface 



If you built the emulator device table and set the HPTABLES shell 
environment variable as shown in the HP 64700 Emulators PC 
Interface: User's Reference, you can start up the 70136 PC Interface by 
entering the following command from the MS-DOS prompt: 

C> pcv33 <emulname> 
where <emulname> is emuI_coml if your emulator is connected to the 
COMl port or emul_coiii2 if it is connected to the COM2 port. If you 

edited the \hp64700\tables\64700tab file to change the emulator name, 
substitute the appropriate name for <emulname> in the above 
command. 

In the command above, pcv33 is the command to start the PC 
Interface; "<emulname>" is the logical emulator name given in the 
emulator device table. (To start the version of the PC Interface that 
supports external timing analysis, substitute ptv33 for pcv33 in this 
command.) If this command is successful, you will see the display 
shown in figure 2-2. Otherwise, you will see an error message and 
retum to the MS-DOS prompt. 



=Code= 



■Enulation. 



=Analysis= 





STftTUS: 


N7B136 — EMulation reset 


EMulation trace halted 


Uindoul 


SysteM Register Processor 


Breakpoints Henory Config flnalijsis 


Actiue 


Delete Erase Load Open 


Store Utility Zoom 



Figure 2-2. PC Interface Display 
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Selecting PC 
Interface Commands 



This manual will tell you to "select" commands. You can select 
commands or command options by using the left and right arrow keys 
to highlight the option. Then press the Enter key. Or, you can simply 
type the first letter of that option. If you select the wrong option, press 
the ESC key to retrace the command tree. 

When a command or option is highlighted, the bottom line of the 
display shows the next level of options or a short message describing 
the current option. 



Emulator Status 



The emulator status is shown on the line above the command options. 
The PC Interface periodically checks the status of the emulator and 
updates the status Une. 



Mapping Memory 



The 70136 emulator contains high-speed emulation memory (no wait 
states required) that can be mapped at a resolution of 256 bytes. 



Note 



4 



When you use the NEC uPD7229 1 coprocessor on your target system 
connected to 70136 microprocessor, the uPD72291 can access 70136 
emulation memory on coprocessor memory read/write cycles. In this 
case, you should reset the target system to cormect the 70136 emulator 
to the uPD72291 coprocessor before starting emulation session. 

Refer to "In-Circuit Emulation Topics" chapter for more information 
about accesses to emulation memory. 
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The memory mapper allows you to characterize memory locations. It 
allows you specify whether a certain range of memory is present in the 
target system or whether you wiU be using emulation memory for that 
address range. You can also specify whether the target system memory 
is ROM or RAM, and you can specify that emulation memory be 
treated as ROM or RAM. 



Note ^fit Tai^et system accesses to emulation memory are not allowed. 

Target system devices that take control of the bus (for example, DMA 
controllers) cannot access emulation memory. 



Blocks of memory can also be characterized as guarded memory. 
Guarded memory accesses will generate "break to monitor" requests. 
Writes to ROM will generate "break to monitor" requests if the "Enable 
breaks on writes to ROM?" configuration item is enabled (see the 
"Configuring the Emulator" chapter). 

The memory mapper allows you to define up to 16 different map terms. 



Which Memory 
Locations Should Be 
l\/lapped? 



Typically, assemblers generate relocatable files and hnkers combine 
relocatable files to form the absolute file. The linker load map hsting 
will show what locations your program will occupy in memory. For 
example, the HP 64853 linker load map listing for the sample program 
is shown in figure 2-3. 



HP 64000+ Linker 



FILE/PROG NAME 



PROGRAM 



DATA 



COMMON 



ABSOLUTE 



CMD_RDS.R 00000400 00000600 00000800 

next address 00000452 00000636 000008FB 

XFER address = 00000400 Defined by CMD_RDS.R 

Absolute file name = CMD_RDS.X 

Total number of bytes loaded = 00000183 



Figure 2-3. Sample Program Load Map Listing 
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From the load map listing, you can see that the sample program 
occupies locations in three address ranges. The program area, which 
contains the opcodes and operands which make up the sample program, 
occupies locations 400 hex through 451 hex. The data area, which 
contains the ASCII values of the messages the program displays, is 
occupies locations 600 hex through 635 hex. The destination area, 
which contains the command input byte and the locations of the 
message destination and the stack, occupies locations 800 hex through 
8FA hex. 

Two mapper terms wiU be specified for the example program. Since 
the program writes to the destination locations, the mapper block 
containing the destination locations should not be characterized as 
ROM memory. 

To map memory for the sample program, select: 
Config, Map, Modify 

Using the arrow keys, move the cursor to the "address range" field of 
term 1. Enter: 

0 . . 07f f@e 

Notice that "@e" must be added in mapping memory; "@e" is the 
function code to define as an extended address. Refer to the "Address 
Expression" section in "Using the Emulator" chapter. 

Move the cursor to the "memory type" field of term 1, and press the 
TAB key to select the erom (emulation ROM) type. Move the cursor 
to the "address range" field of term 2 and enter: 

0800. .09ff@e 

Move the cursor to the "memory type" field of term 2, and press the 
TAB key to select the eram (emulation ROM) type. To save your 
memory map, use the right arrow key or the Enter key to exit the field 
in the lower right corner. (The End key on Vectra keyboards moves 
the cursor directiy to the last field.) The memory configuration display 
is shovm in figure 2-4. 
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-MeMory Map Conf iguration- 



Unnapped MBMory type [^^^ 
Address Range Menory Type Bus Size 




Field editing 



TAB : Scroll choices 



status: N7B13B— EMulation reset 



EMulation trace halted 



Use the TAB and Shift-TAB keys to pick bus size for Mapped range. 



Figure 2-4. Memory Map Configuration 

For your programs (not the sample), you may want to map emulation 
memory locations containing programs and constants (locations that 
should not be written to) as ROM. This will prevent programs and 
constants from being written over accidentally, and will cause breaks 
when instructions attempt to do so. 



Not© Th^ memory mapper reassigns blocks of emulation memory after the 

insertion or deletion of mapper terms. Suppose you modified the 
contents of 400H-7FFH above, deleted term 1, then displayed locations 
400H-7FFH. You'll notice the contents of those locations differ before 

and after you delete the mapper term. 
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Loading Programs 
into Memory 



File Format 



Target Memory Type 
for Memory Load 



If you have already assembled and linked the sample program, you can 
load the absolute file by selecting: 



Memory, Load 

Use Tab and Shift-Tab to select the format of your absolute file. The 
emulator accepts absolute files in the following formats: 

■ Intel OMF86 absolute. 

■ NEC30 absolute. 

- (This absolute file is generated by NEC LK70136 linker 
foruPD70136.) 

■ NEC33 absolute. 

- (This absolute file is the extended load module format file 
which is generated by NEC EL70136 extended mode 
locator for uPD70136.) 

■ HP64000 absolute. 

■ Raw HP64000 absolute. 

■ Intel hexadecimal. 

■ Motorola S-records. 

■ Tektronix hexadecimal. 

For this tutorial, choose the HP64000 format. 

The second field allows you to selectively load the portions of the 
absolute file which reside in emulation memory, target system 
memory, both emulation and target system memory. 

Since emulation memory is mapped for sample program locations, you 
can select either "emulation" or "both". Use Tab key and Shift-Tab to 
cycle through the choices. 
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Force the Absolute 
File to Be Read 



This option is only available for the Intel OMF86, NEC30, NEC33, and 
HP64000 absolute file formats. 



It forces the file format reader to regenerate the emulator absolute file 
(.hpa) and symbol database (.hps) before loading the code. Normally, 
these files are only regenerated whenever the file you specify (the 
output of your language tools) is newer than the emulator absolute file 
and symbol database. 

For more information, refer to the File Format Readers appendix. 



File Format Options Some of the formats, such as the Intel OMF86 format, have special 

options. 

Refer to the File Format Readers appendix of this manual for more 
information. 



Absolute File Name For most formats, you enter the name of your absolute file in the last 

field. The HP64000 format requires the hnker symbol filename instead. 
Type cmd_rds.l, and press Enter to start the memory load. 

nenory Load Configuration 



File ForMat 

Target nenory t^jpe for nenory load 
Force the absolute File to be read 



Absolute file nane 



lend rds.L 



<-Ti-> : Interf ield nouenent Ctrl <--> : Field editing TAB : Scroll choices 



STATUS: N7B136— EMulation reset Enulation trace halted 

Enter the nane of an HP64eBe linker sijnbol file Cex. test.L>. 
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Displaying 
Symbols 



Symbol files are created when you generate absolute files with the 
HP 64000-PC Cross Assembler/Linkers. When you assemble a source 
file, an assembler symbol file (with the same base name as the source 
file and a .a extension) is created. The assembler symbol file contains 
local symbol information. When you Unk relocatable assembly 
modules, a linker symbol file (with the same base name as the absolute 
file and a .1 extension) is created. The linker symbol file contains 
global symbol information and information about the relocatable 
assembly modules that combine to form the absolute file. 

When you load a file using the HP64000 file format, the file format 
reader collects global symbol information from the linker symbol file 
and local symbol information from the assembler symbol files. It uses 
this information to create a single symbol database with the extension 
.hps. 

If you load a file using the following formats, the file format reader 
obtains all the global and local symbol information from the absolute 
file and builds a symbol database with extension .hps. 



■ Intel OMF86 absolute. 



■ NEC30 absolute. 



■ NEC33 absolute. 



The following pages show you how to display global and local symbols 
for the sample program. For more information on symbol display, refer 
to the PC Interface Reference. 
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Displaying Global 
Symbols 



When you load a file using the following formats into the emulator, the 
corresponding symbol database is also loaded. 



■ Intel OMF86 absolute. 

■ NEC30 absolute. 

■ NEC33 absolute. 

■ HP64000 absolute. 

The symbol database also can be loaded with the System, Symbols, 
Global, Load command. Use this command when you load multiple 
absolute files into the emulator. You can load the various symbol 
databases corresponding to each absolute file. When you load a symbol 

database, information from a previous symbol database is lost. That is, 
only one symbol database can be present at a time. 

After a symbol database is loaded, both global and local symbols can 
be used when entering expressions. You enter global symbols as they 
appear in the source file or in the global symbols display. 
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To display global symbols, select: 

System Symbols Global Display 

The symbols window automatically becomes the active window 
because of this command. You can press <CTRL>z to zoom the 
window. The resulting display follows. 



CnD_RDS. s 
Address Synbol 



■Synbolsg 



Modules 



Beam: 00800 Cnd_Input 

88808:06488 I nit 

88888:88801 Msg.Dest 

88888:88688 Msgs 



STftTUS: 


N78136- 


-Enulation reset 


EMulation trace halted 


Jindou 


ISystenl 


Register Processor 


Breakpoints Menory Config Analysis 



Comiand_file Uait MS-DOS Log Teriiinal Saiibols Exit 



The global symbols display has two parts. The first part lists all the 
modules that were linked to produce this object file. These module 
names are used by you when you want to refer to a local symbol, and 
are case-sensitive. The second part of the display hsts all global 
symbols in this module. These names can be used in measurement 
specifications, and are case-sensitive. For example, if you wish to make 
a measurement using the symbol Cmd_Input, you must specify 
Cmd_Input. 

The strings cmd_input and CMD_INPUT are not vaUd symbol names 
here. 
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Loading and 
Displaying Local 
Symbols 



To display local symbols, select: 



System Symbols Local Display 

Enter the name of the module you want to display (from the first part of 
the global symbols list; in this case, CMD_RDS.S) and press Enter. 
The resulting display follows. 



■SyMbolSg 



Address 



SijNbol 



88880 : 
88888: 

aeaae: 

88888: 
88888: 
88868: 
88688: 
88688: 
86666: 
88688: 
86666: 
88666: 
88888: 

aeeae: 

88888: 
88888: 
86868: 



88429 
88432 
88436 
88888 
88636 
8841E 
66446 
88488 
66666 
68612 
86861 
66624 
88688 
8e48F 
88416 
888F9 
86441 



CMd_A 

CMd_B 

CMd_I 

CMd_ Input 

End_(1sgs 

Exe_CMd 

Fill_Dest 

Init 

Msg_A 

Msg_B 

Msg_Dest 

Msg_I 

Msgs 

Read_CMd 

Scan 

Stk 

Urite_Msg 



status: 


N78136- 


-Enulation reset 


Enulation trace halted 


iJindou 


|Sijsten| 


Register Processor 


Breakpoints Menory Config Analysis 



Coiiiiand_file Uait MS-DOS Log TerMinal Saiibols Exit 



After you display local symbols with the System Symbols Local 
Display command, you can enter local symbols as they appear in the 
source file or local symbol display. When you display local symbols 
for a given module, that module becomes the default local symbol 
module. 
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If you have not displayed local symbols, you can still enter a local 
symbol by including the name of the module: 

module_name : symbol 

Remember that the only valid module names are those listed in the first 
part of the global symbols display, and are case-sensitive for 
compatibility with other systems (such as HP-UX). 

When you include the name of an source file with a local symbol, that 
module becomes the default local symbol module, as with the System 
Symbols Local Display command. 

Local symbols must be from assembly modules that form the absolute 
whose symbol database is currently loaded. Otherwise, no symbols will 
be found (even if the named assembler symbol file exists and contains 
information). 

One thing to note: It is possible for a symbol to be local in one module 
and global in another, which may result in some confusion. For 
example, suppose symbol XYZ is a global in module A and a local in 
module B and that these modules link to form the absolute file. After 
you load the absolute file (and the corresponding symbol database), 
entering XYZ in an expression refers to the symbol from module A. 
Then, if you display local symbols from module B, entering XYZ in 
an expression refers to the symbol from module B, not the global 
symbol. Now, if you again want to enter XYZ to refer to the global 
symbol from module A, you must display the local symbols from 
module A (since the global symbol is also local to that module). 
Loading local symbols from a third module, if it was linked with 
modules A and B and did not contain an XYZ local symbol, would 
also cause XYZ to refer to the global symbol from module A. 
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Transfer Symbols to 
the Emulator 

System Symbols Global Transfer 

Transfer the local symbol information for all modules by entering: 
System Symbols Local Transfer All 

You can find more information on emulator symbol handling 
commands in the Emulator PC Interface Reference. 



You can use the emulator's symbol-handling capabiUty to improve 
measurement displays. You do this by transferring the symbol 
database information to the emulator. To transfer the global symbol 
information to the emulator, use the command: 



PGR register You can configure the 70136 emulator to break to the monitor to read 

the current value of page registers when the emulation system needs to 
convert normal address to extended address. 

However, the normal address mode is only used in this sample program. 

You should change the configuration not to break to the monitor to 
read page registers in the general emulator coirfiguration. Select: 

Config, General 

Use the arrow keys to move the cursor to the "Read PGR register" 
field, answer [n], press End to move to the lower right corner, and 
press Enter to exit the general emulator configuration. 

See the "Configuring the Emulator" chapter for a complete description 
of the emulator configuration. 
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Displaying 
Memory in 
Mnemonic Format 



Once you have loaded a program into the emulator, you can verify that 
the program has indeed been loaded by displaying memory in 
mnemonic format. To do this, select: 



Memory, Display, Mnemonic 

Enter the address range "400H..429H". You could also specify this 
address range using symbols. 

For example, 

"Init.Cmd_A" or "Init.Init+29H". 

The Emulation window remains active. You can press <CTRL>z to 
zoom the memory window. The resulting display follows. 

If you want to see the rest of the sample program memory locations, 
you can select "Memory, Display, Mnemonic" command and enter the 
range from 42AH to 45 IH. 



.Enulationi 



f^ddress 



SyHbol 



MneNonic 



88880:88400 
88800:08403 
80880:08408 
00888: 8840f 
00000:08415 
88888:88416 
88880: 0041a 
00000:0041c 
00800 :0041e 
00808:08428 
00888:88422 
88808: 88424 
00088:88426 
00880:80429 



CHD RDS.S:CNd A 



cm RDS.S:Scan 



D RDS.S:Exe Cnd 



Init 



RDS.S:Read Cnd 



nou (\u.m0m 

nOU DSO,AU I hOU AU,tt0008 

nou Dsi,Au I nou ss.m i nou sp.sesf 

nou DSl:Q800,tt00 
NOP 

nou ^1L,DSl:O800 
CnP AL,tt00 
BE/Z CnD_RDS.S:Scan 
CnP AL,tt41 

BE/Z CnD_RDS.S:Cnd_A 
CnP AL,«42 

BE/Z CnD_RDS.S:CHd_B 

BR NEAR PTR CnD_RDS.S:Cnd_I 

nou CUjS8B12 




Uindou SystEM Register Processor Breakpoints 
Display nodifjj Load Store Copa Find Report 
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stepping Through 
the Program 



aa8ee:BB488 init nou Au^neaee 

PC = 08088:80483 

u = 8888 bu = 5400 cu = 0000 du = FF80 Ix 
ds8 = 8888 dsl = 8880 ss = 0888 ps = 8888 pc 
sp = 8FFr bp = 8880 



The emulator allows you to execute one instruction or a number of 
instructions with step command. To begin stepping through the sample 
program, select: 

Processor, Step, Address 

Enter a step count of 1, enter the symbol Init (defined as a global in the 
source file), and press Enter to step from program's first address, 
400H. The Emulation window remains active. Press <CTRL>z to 
view a full screen of information. The executed instruction, the 
program counter address (PS:PC), and the resulting register contents 
are displayed as shown in the following. 
^^^^^^^^■Enu 1 at 1 or^^^^^^^^^^^^^^^^^^^^^^H 



2FFF iy = 0180 
8403 psu = F082 



Go Break Reset I/O CHB Step 



Breakpoints henory ConFlg Analijsis 



4 



NotG imI You cannot display registers if the processor is reset. 

Use the "Processor Break" command to cause the emulator to start 
executing in the monitor. 

You can display registers while the emulator is executing a user 
program (if execution is not restricted to real-time); emulator execution 
will temporarily break to the monitor. 
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Note 



There are a few cases in which the emulator can not step. Step 
command is not accepted between each of the following instructions 
and the next instruction. 



1) Manipulation instructions for sreg : 

MOV sreg^egl6; MOV sreg,meml6; POP sreg. 

2) Prefix instructions: PS:, SS:, DSO:, DSl:, REPC, REPNC, 
REP, REPE, REPZ, REPNE, REPNZ, BUSLOCK. 

3) EL RETL DI. 



Note 




You cannot use over 100000 hex address in "Processor Step" command. 



To continue stepping through the program, you can select: 
Processor, Step, Pc 

After selecting this command, you can change the previous step count. 
If you wish to step the same number of times, just press Enter to start 
the step. 

To save time when single-stepping, you can use the function key macro 
<F1>, which executes the command: 

Processor Step Pc 1 

For more information, see the Emulator PC Interface Reference 
chapter on Function Key Macros. 

To repeat the previous command, you can press <CTRL>r. 
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Specifying a Step 
Count 



If you want to step sevral times from the current program counter, 
select: 



Processor, Step, Pc 

The previous step count is displayed in the "number of instructions" 
field. You can enter a number from 1 through 99 to specify the number 
times to step. Type 5 into the field, and press Enter. The resulting 
display follows. 

When you specify step counts greater than 1, only the last instruction 
and the register contents after that instruction are displayed. 



■Enulation 



08888:80403 - 



nou Dse,i!iu i mou 



M, 1(8888 



PC = 88888:88488 
au = 8888 bu = 

dsB = 8888 dsl = 
sp = 8fFF bp = 



B488 cu 
8888 ss 
8888 



8888 du = fF88 ix = 
8888 ps = 8888 pc = 



Zffr itj = 8188 
8488 psu = F88Z 



08888:66468 - I10U DS1,AU I MOU 

66666: 6646f _RDS. S: Read_CMd MOU DSl: 6866, tt68 
06666:66415 - NOP 



SS.M 



MOU SP,tt88f 



66666:66416 CMD_RDS. S: Scan MOU AL, DSl: 8888 
66666:6641a - CMP |!|L,n88 



PC = 06660:6041c 



au = 0000 bu = 5400 cu = 0666 du = rf86 ix = 
dse = 6666 dsl = 6666 ss = 8668 ps = 6866 pc = 
sp = 88f 9 bp = 8888 



Zfff iy = 6186 
641c psu = f848 




Uindou Systen Register [yfJ^Sj^ 
Go Break Reset I/O CMB Step 
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Modifying Memory 



The preceding step commands show the sample program is executing 
in the Scan loop, where it continually reads the command input byte to 
look for a command. 



To simulate the entry of a sample program command, you can modify 
the command input byte by selecting: 

Memory, Modify, Byte 
Now enter the address of the memory location to be modified, an equal 
sign, and new value of that location, for example, Cmd_Input="A". 
(The Cmd_Input label was defined as a global symbol in the source 
file.) 

To verify that "A" was indeed written to Cmd_Input (800 hex), select: 

Memory, Display, Byte 
Type the address 800H or the symbol Cmd_Input, and press Enter. 
The resulting display is shown below. 





Synbo 1 i> 




Address Sijnbol 






00888:88429 CMd_A 






00000:88432 Cnd B 






00000: 0043B Cnd_I 








Address Data (hex) 




Ascii 


00080:08800 41 









status: 


N70136- 


-Running in Monitor 


Enulation trace halted 


Jindou 


SijsteM 


Register IHgiTitjBSiH 


Breakpoints Henory Config Analysis 



Go Break Reset I/O CKB Step 



You can continue to step through the program as shown earlier in this 
chapter to view the instructions which are executed when an "A" (41 
hex) command is entered. 
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Running the 
Program 



To start the sample program, select: 



Processor, Go, Pc 
The status line will show that the emulator is "Running user program". 



Note 




You can not use over 100000 hex address in "Processor Go" command. 



You can search the message destination locations to verify that the 
sample program writes the appropriate messages for the allowed 
commands. The command "A" (41 hex) was entered above, so the 
"Command A entered " message should have been written to the 
Msg_Dest locations. Because you must search for hexadecimal values, 
you will want to search for a sequence of characters which uniquely 
identify the message, for example, 

" A " or 20 hex, 41 hex, and 20 hex. To search the destination memory 
location for this sequence of characters, select: 

Memory, Find 

Enter the range of the memory locations to be searched, "800H..820H", 
and enter the data " A " or 20H, 41H, and 20H. The resulting 
information in the Emulation window shows you that the message 
write occurred correctly. The message is: 

Pattern match at address: 0000808@p 

To verify that the sample program works for the other allowed 
commands, you can modify the command input byte to "B" and search 
for " B " (20 hex, 42 hex, and 20 hex), or you can modify the command 
input byte to "C" and search for "d C" (64 hex, 20 hex, and 43 hex). 



Searching 
Memory for Data 
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BrSdkinQ into th© To break emulator execution from the sample program to the monitor 
Monitor program, select: 



Processor, Break 

The status line shows that the emulator is "Ruiming in monitor". 

While the break will occur as soon as possible, the actual stopping 
point may be many cycles after the break request. This depends on the 
type of instruction being executed, and whether the processor is in a 
hold state. 



Using Software 
Brealcpoints 



Software breakpoints are provided with one of 70136 undefined 
opcode (Fl hex) as breakpoint interrupt instruction. 



When you define or enable a software breakpoint, the emulator wiU 
replace the opcode at the software breakpoint address with the 
breakpoint interrupt instruction. 



Caution software breakpoints should not be set, cleared, enabled, or disabled 

w while the emulator is running user code. If any of these commands are 

entered while the emulator is running user code, and the emulator is 
executing code in the area where the breakpoint is being modified, 
program execution may be unreliable. 
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When you use extended address mode, care should be taken for 
software breakpoints. If you change the relation between the physical 
address and the extended address after you set a software breakpoint 
(ex. change address mode or change the contents of the page register), 
emulation system may not recognize the software breakpoint. 

In this case, the breakpoint interrupt instruction (Fl hex) is left in 
memory and the software break will not occur at the specified address. 
When you set a software breakpoint with using symbols, you also 
should not change the relation between the physical address and the 
extended address after setting a software breakpoint. 



You must only set software breakpoints at memory locations which 
contain instruction opcodes (not operands or data). If a software 
breakpoint is set at a memory location which is not an instruction 
opcode, the software breakpoint instruction will never be executed and 
the break will never occur. 



NMI will be ignored, when software breakpoint and NMI occur at the 
same time. 



Because software breakpoints are implemented by replacing opcodes 
with the breakpoint interrupt instruction, you cannot define software 
breakpoints in target ROM. You can use the Terminal Interface dm 
command to copy target ROM into emulation memory (see the 
Terminal Interface Reference manual for information on the cim 
command). 
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Not© ^Bp Do not set, clear, enable or disable software breakpoints while the 
emulator is running user code. If you enter any of these commands 
while the emulator is executing user code in the area of the breakpoint 

you are modifying, program execution may be unreliable. 



Not© I Software breakpoint will be ignored, when software breakpoint and 

other emulation break (for example, break command, trigger command, 
etc.) occur at the same time. Refer to PC Interface: User's Reference 
manual. 



1^ 



When software breakpoints are enabled and emulator detects the 
breakpoint interrupt instruction (Fl hex), it generates a break to 
background request which as with the "processor break" command. 
Since the system controller knows the locations of defined software 
breakpoints, it can determine whether the breakpoint interrupt 
instruction (Fl hex) is a software breakpoint or opcode in your target 
program. 

If it is a software breakpoint, execution breaks to the monitor, and the 
breakpoint interrupt instruction is replaced by the original opcode. A 
subsequent run or step command will execute from this address. 

If it is an opcode of your target program, execution still breaks to the 
monitor, and an "Undefined software breakpoint" status message is 
displayed. 

When software breakpoints are disabled, the emulator replaces the 
breakpoint interrupt instruction with the original opcode. 
Up to 32 software breakpoints may be defined. 
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Defining a Software 
Breakpoint 



To define a breakpoint at the address of the CmdJ label of the sample 
program (43B hex), select: 



Breakpoints, Add 

Enter the local symbol "CmdJ". After the breakpoint is added, the 
Emulation window becomes active and shows that the breakpoint is set. 

You can add multiple breakpoints in a single command by separating 
them with a semicolon. For example, you could type 
"2010h;2018h;2052h" to set three breakpoints. 

Run the program by selecting: 
Processor, Go, Pc 

The status line shows that the emulator is running the user program. 
Modify the command input byte to an invahd command by selecting: 

Memory, Modify, Byte 

Enter an invalid command, such as "Cmd_Input=75h". The following 
messages result: 

ALERT: Software breakpoint: 00000:0043b 
STATUS: Running in monitor 
To continue program execution, select: 

Processor, Go, Pc 
Displaying Software To view the status of the breakpoint, select: 

Brealtpoints 

Breakpoints, Display 
The display shows that the breakpoint was cleared. 
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■Enulationi 



Status 



f)ddress 



Clear 



eeBee:0e43b 




Uindou Sijsten Register Processor 
Display Add ReMooe Set Clear 



Setting a Software 
Breakpoint 



A breakpoint is disabled when it is hit. To re-enable the software 
breakpoint, you can select: 



Breakpoints, Set, Single 

The address of the breakpoint you just added is stiU in the address field. 
To set this breakpoint again, press Enter. 

As with the "Breakpoints Add" command, the Emulation window 
becomes active and shows that the breakpoint is set. 



Breakpoints, Clear, Single 

The address of the breakpoint set in the previous section is still in the 
address field. To clear this breakpoint, press Enter. 



Clearing a Software 
Brealcpoint 



If you wish to clear a software breakpoint that does not get hit during 
program execution, you can select: 
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Using the Analyzer 



The analyzer collects data at each pulse of a clock signal, and saves the 
data (a trace state) if it meets a "storage quaUfication" condition. 



4 



Not© I Emulators which have the optional extemal analyzer will display the 

"Internal/External" option after commands in the following examples. 
Select Internal to execute the example commands. 



Resetting the To be sure that the analyzer is in its default or power-up state, select: 

Analysis 
Specification 

Analysis, Trace, Reset 

Specifying a Simple Suppose you wish to trace the states of the sample program which 

Trigger follow the read of a "B" (42 hex) command from the command input 
byte. To do this, you must modify the default analysis specification by 

selecting: 

Analysis, Trace, Modify 

The emulation analysis specification is shown. Use the right allow key 
to move the "Trigger on" field. Type "a" and press Enter. 

You'll enter the pattem expression menu. Press the up arrow key until 
the addr field directly opposite the pattem a= is highlighted. Type the 
address of the command input byte, using either the global symbol 
Cmdjnput or address 800H, and press Enter. 

The Data field is now highlighted. Type 0XX42 and press Enter. "42" 
is the hexadecimal value of the B command and the "X"s specify 
"don't care" values. When 42H is read from the command input byte 
(800H), a lower byte read is performed because the address is even. If 
the address is odd, you must specify the data to 42XX. 

Now the Status field is highUghted. Use the TAB key to view the 
status qualifier choices. 
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Qualifier 


Status Bits 




Description 


bsl6 


Oxx 


xxlx 


xxxx 


xxxxB 


Bus size 16 


bs8 


Oxx 


xxOx 


xxxx 


xxxxB 


Bus size 16 


coproc 


0x0 


xxxx 


xl 0 1 


xOxxB 


Co-processor access 


cprd 


0x0 


xxxx 


xl 0 1 


xO IxB 


Co-processor read 


cpwr 


0x0 


xxxx 


xlOl 


xO OxB 


Co-processor write 


exec 


0x0 


xxxx 


xOxx 


xxxxB 


Executed code 


extaddr 


Oxx 


Ixxx 


xxxx 


xxxxB 


Extended address mode 


extmemrd 


0x0 


Ixxx 


1110 


xllxB 


memory read in extended address mode 


extmemwr 


0x0 


Ixxx 


1110 


xlOxB 


memory write in extended address mode 


fetch 


0x0 


xxxx 


1100 


xl IxB 


P rogram fetch 


grdacc 


Oxx 


xxxx 


Oxxx 


xlxxB 


Guarded access 


haltack 


0x0 


xxxx 


xl 1 1 


xOOxB 


Halt acknowledge 


holdack 


0x1 


xxxx 


xxxx 


xxxxB 


Hold acknowledge 


intack 


0x0 


xxxx 


xlOO 


xO IxB 


Interrupt acknowledge 


io 


0x0 


xxxx 


xllO 


xOxxB 


I/O access 


ioread 


0x0 


xxxx 


xllO 


xOlxB 


I/O read 


iowrite 


0x0 


xxxx 


xllO 


xOOxB 


I/O write 


memory 


0x0 


xxxx 


1110 


xlxxB 


memory access 


memf orcp 


0x0 


xxxx 


1101 


xlxxB 


memory access for cp 


memread 


0x0 


xxxx 


1110 


xllxB 


memory read 


memrdcp 


0x0 


xxxx 


1101 


xllxB 


memory read for cp 


memwrite 


0x0 


xxxx 


1110 


xlOxB 


memory write 


memwrcp 


0x0 


xxxx 


1101 


xlOxB 


memory write for cp 


mon 


Oxx 


xOxx 


xxxx 


xxxxB 


monitor cycle 


nmladdr 


Oxx 


Oxxx 


xxxx 


xxxxB 


normal address mode 


nmlmemrd 


0x0 


Oxxx 


1110 


xllxB 


memory read in normal address mode 


nmlmemwr 


0x0 


Oxxx 


1110 


xlOxB 


memory write in normal address mode 


read 


0x0 


xxxx 


xlxx 


xxlxB 


read cycle 


write 


0x0 


xxxx 


xlxx 


xxOxB 


write cycle 


wrrom 


Oxx 


xxxO 


xxxx 


xxOxB 


write to ROM 



70136 Analysis Status Qualifiers 

This trace command example uses the status quaUfier "read". The 
following analysis status qualifiers also can be used with the 70136 
emulator. 
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Qualifier 


Status Bits 




bsl6 


Ixxx 


xxlx 


xxxx 


xxxxB 


bs8 


Ixxx 


xxOx 


xxxx 


xxxxB 


coproc 


IxxO 


xxxx 


xlO 1 


OOxxB 


cprd 


IxxO 


xxxx 


xlO 1 


00 IxB 


cpwr 


IxxO 


xxxx 


xlOl 


OOOxB 


dma_mem 


IxxO 


xxxx 


xllO 


llxxB 


dma_memrd 


IxxO 


xxxx 


xllO 


lllxB 


dma_memwr 


IxxO 


xxxx 


xllO 


llOxB 


dma_cscd 


Oxxx 


xxxx 


xxxx 


xxxxB 


ext_io 


IxxO 


xxxx 


xllO 


OOxxB 


ext_iord 


IxxO 


xxxx 


xl 10 


00 IxB 


ext_iowr 


IxxO 


xxxx 


xl 1 0 


0 0 OxB 


exec 


IxxO 


xxxx 


xOxx 


xxxxB 


extaddr 


Ixxx 


Ixxx 


xxxx 


xxxxB 


extmemrd 


IxxO 


Ixxx 


1110 


0 1 IxB 


extmemwr 


IxxO 


Ixxx 


1110 


0 1 OxB 


fetch 


IxxO 


xxxx 


1100 


0 1 IxB 


grdacc 


Ixxx 


xxxx 


Oxxx 


xxxxB 


haltack 


IxxO 


xxxx 


xlll 


OOOxB 


holdack 


Ixxl 


xxxx 


xxxx 


xxxxB 


int acki 


IxxO 


xxxx 


xlOO 


1 0 IxB 


intacks 


IxxO 


xxxx 


xl 0 0 


0 0 IxB 


int_io 


IxxO 


xxxx 


xl 1 0 


1 OxxB 


int iord 


IxxO 


xxxx 


xllO 


1 0 IxB 


int_iowr 


IxxO 


xxxx 


xllO 


lOOxB 


memory 


IxxO 


xxxx 


1110 


OlxxB 


memf orcp 


IxxO 


xxxx 


1101 


OlxxB 


memread 


IxxO 


xxxx 


1110 


OllxB 


memrdcp 


IxxO 


xxxx 


1101 


OllxB 


memwrite 


IxxO 


xxxx 


1110 


OlOxB 


memwrcp 


IxxO 


xxxx 


1101 


OlOxB 


mon 


Ixxx 


xOxx 


xxxx 


xxxxB 


nmladdr 


Ixxx 


Oxxx 


xxxx 


xxxxB 


nmlmemrd 


IxxO 


Oxxx 


1110 


OllxB 


nmlmemwr 


IxxO 


Oxxx 


1110 


OlOxB 


read 


IxxO 


xxxx 


xlxx 


xxlxB 


refresh 


IxxO 


xxxx 


xlOO 


lllxB 


write 


IxxO 


xxxx 


xlxx 


xxOxB 


wrrom 


Ixxx 


xxxO 


xlxx 


xxOxB 



DeRcription 

bus size 16 
bus size 8 
co-processor access 
co-processor read 
co-processor write 
DMA cycle 
DMA read cycle 
DMA write cycle 
DMA cascade 
external I/O access 
external I/O read 
external I/O write 
executed code 
extended address mode 

memory read in extended address mode 
memory write in extended address mode 
program fetch 
guarded access 

halt acknowledge 

hold acknowledge 

interrupt acknowledge (ICU) 

interrupt acknowledge (SLAVE) 

internal I/O access 

internal I/O read 

internal I/O write 

memory access 

memory access for cp 

memory read 

memory read for cp 

memory write 

memory write for cp 

monitor cycle 

normal address mode 

memory read in normal address mode 
memory write in normal address mode 
read cycle 

refresh cycle 
write cycle 
write to ROM 



70236 Analysis Status Qualifiers 

This trace command example uses the status quahfier "read". The 
following analysis status quaUfiers also can be used with the 70236 
emulator. 



Getting Started 2-33 



J] Uhile stori ng 
Trigger on 



Internal State Trace Specification 
tines 



g Store 



anij state 



Branches QJ^^^^^ Count [^^^ Prestore Qjy Trigger position 

of 512 

«-ti-> :lnterfield nouenent Ctrl «--» :Fleld editing TAB :Scroll choices 



STATUS: N7B136— Running user prograM 



EMulation trace halted 



TAB selects CDnsert sequence leuel, <D)elete leuelj or set (T)rigger leuel. 



Figure 2-5. Modifying the Trace Specification 



Internal State Trace Specification 
Set 1 



Range (r> Label 
Pat 



I 



-addr- 



I 



Cnd_Input 



Set 2 



thru 
— data- 



exx4Z 



stat- 



read 



e 
f 
9 
h 
arn 

Expression 

Expressions haue the forn: <setl> and/or <set2>. Uhere setl consists of <a, 
b,c,d,r, !r> and set2 consists of <e, £ , ^, h, arn^ . Patterns uithin a set can be 
Joined uith !<or) or ~(nor); but not both. ExaMple: ! r ~ a or e I f I g | h 
Pattern Expression 



STATUS: N7B136— Running user prograM 



EMulation trace halted 



TAB selects a siMple pattern or enter an expression or Moue up to edit patterns. 



Figure 2-6. lUlodifying the Pattern Specification 
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NotG You can combine qualifiers to form more specific qualifiers. For 

example, the expression memory&&read matches only memory 
reads. See the Emulator PC Interface Reference for more iirformation. 



Select the read status and press Enter. 

The resulting analysis specification is shown in figure 2-5. To save the 
new specification, use End Enter to exit the field in the lower right 
corner. You'll return to the trace specification. Press End to move the 
"trigger position" field. Use the TAB key until it says center, then 
press Enter to exit the trace specification. 



Starting the Trace To start the trace, select: 



Analysis, Begin 



A message on the status line will show you that the trace is running. 
You do not expect the trigger to be found, because no commands have 
been entered. Modify the command input byte to "B" by selecting: 

Memory, Modify, Byte 

Enter Cmd_Input="B". The status line now shows that the trace is 
complete. (If you have problems, you may be running in monitor. 
Select Processor Go Pc to retum to the user program.) 



Change the Analyzer 
Display Format 



To change the analyzer display format, enter the command: 



Analysis Format 

Use the dovm arrow key to move to the field labeled addr. And, use 
the right arrow key to move the field labeld Width above. The default 
width of the address column is six characters. A width of 17 characters 
is often wide enough to accommodate most symbol names. Type 17 to 
change the width of the address column, and press End, then Enter. 



Displaying the Trace To display the trace, select: 
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Analysis, Display 



You are now given two fields in which to specify the states to display. 
Use the End key to move the cursor to the "Ending state to display" 
field. Type 60 into the press Enter. The resulting trace is similar to 
trace shown in the following display (use <CTRL>z to zoom the trace 
window). You may need to press the Home key to get to the top of the 
trace. 



Line 


addr^ H 


70236 MnBMonicH 




count, R 


-7 


Bee41c 


f874 


prefetch 


N 


0.440 uS 


-6 


aQ041c 


BE/Z 


000416 




0.160 uS 


-B 


8ee41e 


413c 


prefetch 


N 


0.400 uS 


-4 


060416 


a026 


prefetch 


N 


0.560 uS 


-3 


000418 


0800 


prefetch 


N 


0.560 uS 


-2 


000416 


MOU 


AL.DSl:080e 




0.240 uS 


-1 


00041a 


003c 


prefetch 


N 


0.320 uS 


8 


0008B8 


xx42 


nenori) read 


N 


0.560 uS 


1 


00041a 


CMP 


ai.um 




0.120 uS 


2 


00041c 


f874 


prefetch 


N 


0.440 uS 


3 


00041c 


BE/Z 


000416 




0.200 uS 


4 


00041e 


413c 


prefetch 


N 


0.360 uS 


5 


00041e 


CMP 


flL,tt41 




0.200 uS 


6 


0004Z0 


0774 


prefetch 


N 


0.360 uS 


7 


000420 


BE/Z 


000429 




0.200 uS 


8 


688422 


423c 


prefetch 


N 


8.368 uS 



seq 



STATUS: N70235~Running user prograM 



Eiiulation trace coiiplete 

Analijsis 



Uindou Sijsten Register Processor Breakpoints nenory Config 
Begin Halt CMB Fornat Trace Display 



NotG character displayed in the right side of disassemble list specifies 

the following information. 



Character | Information 

N I Normal address mode 

E I Extended address mode 

M I Monitor cycle (background) 
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Running in the user program, symbols can not be displayed in the trace 
list. 



When you use the following setting in your program, the branch 
address forming in PC relative addressing may change to a wrong 
value in disassemble trace list. 

■ The program is running in the extended address mode. 

■ The effective address for the PC relative addressing is in the 
other page. 

■ The order of the pages is not in sequence in extended address. 



If you choose to dump a complete trace into the trace buffer, it will 
take a few minutes to display the trace. 
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Line 0 in the above trace list shows the analyzer trigger state. The 
trigger state is always on line 0. The other states show the exit from 
the Scan loop and the Exe_Cmd instructions. 

Processor, Break 
Analysis, Display 



■Analysis^ 



Line 


addr, H 


7BZ36 nnenonic, H 




count, R 


9 


860422 


CMP 


AL, 842 




6.286 uS 


10 


B80424 


6c74 


prefetch 


N 


6.366 uS 


11 


668424 


BE/Z 


CMD_RDS.S:Ciid_B 




6.286 uS 


12 


666426 


12e9 


prefetch 


N 


6.366 uS 


13 


:Cnd B 


12b9 


prefetch 


N 


6.566 uS 


14 


666434 


be86 


prefetch 


N 


6.686 uS 


15 


:Cnd B 


MOU 


CU, 88612 




6.166 uS 


16 


066436 


6612 


prefetch 


N 


6.486 uS 


17 


866435 


MOU 


IX, 88612 




6.246 uS 


18 


866438 


66e9 


prefetch 


N 


6.326 uS 


19 


86643a 


b986 


prefetch 


N 


6.566 uS 


ze 


866438 


BR 


NEfiR PTR CMD_RDS.S:UritB_Msg 


6.166 uS 


21 


86643c 


6812 


prefetch 


N 


6.486 uS 


22 


te Msg 


bfxx 


prefetch 


N 


6.566 uS 


23 


866442 


6881 


prefetch 


N 


6.566 uS 


Z4 


tB_Msg 


nou 


ly, 88881 




8.248 uS 



seq 



STftTUS: 


N78236- 


-Running in Monitor 


EMulation trace couplets 


Jindou 


Systen 


Register Processor 


Breakpoints Menory Config ^Q^^^ 



Begin Halt CUB Forwat Trace Display 



The resulting display shows the Cmd_B instructions, the branch to 
Write_Msg, and the beginning of the instructions that move the 
Entered B command message to the destination locations. 



For a Complete 
Description 



For a complete description of using the HP 64700 Series analyzer with 
the PC Interface, refer to the Analyzer PC Interface User's Guide. 
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You can copy the contents of one range of memory to another. This is 
a useful feature to test things like the relocatability of programs. To 
test if the sample program is relocatable within the same segment, copy 
the program to an unused, but mapped, area of emulation memory. For 

example, select: 

Memory, Copy 

Enter 400H through 452H as the source memory range to be copied, 
and enter 500H as the destination address. 

To verify that the program is relocatable, run it from its new address 
by selecting: 

Processor, Go, Address 

Enter 500H. The status line shows that the emulator is "Running user 
program". You may wish to trace program execution or enter valid and 
invalid commands and search the message destination area (shown 
earUer in this chapter) to verify that the program works correctly at its 
new address. 



Resetting the To reset the emulator, select: 

Emulator 

Processor, Reset, Hold 

The emulator is reset (suspended) until you enter a "Processor Break", 
"Processor Go", or "Processor Step" command. A CMB execute 
signal also wiU run the emulator if reset. 

You also can specify that the emulator begin executing in the monitor 
after reset instead of remaining in the suspended state. 

To do this, select: 

Processor, Reset, Monitor 



Copying Memory 



Getting started 2-39 



There are three different ways to exit the PC Interface. You can exit 
the PC Interface using the "locked" option which restores the current 
configuration next time you start the PC Interface. You can select this 
option as follows. 

System, Exit, Locked 

Another way to execute the PC Interface is with the "unlocked" 
option, which presents the default configuration the next time you start 
the PC Interface. You can select this option with the following 
command. 

System, Exit, Unlocked 

Or , you can exit the PC Interface without saving the current 
configuration using the command: 

System Exit No_Save 

See the Emulator PC Interface Reference for a complete description of 
the system exit options and their effect on the emulator configuration. 



Exiting the PC 
Interface 
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3 



In-Circuit Emulation 



Introduction The emulator is in-circuit when it is plugged into the target system. 

This chapter covers topics which relate to in-circuit emulation. 

This chapter will: 



■ Describe the issues concerning the installation of the emulator 
probe into target systems. 

■ Show you how to install the emulator probe. 

■ Show you how to use features related to in-circuit emulation. 



Pr6r6C|U isitOS Before performing the tasks described in this chapter, you should be 

familiar with how the emulator operates in general. Refer to the 
Concepts ofEmualtion and Analysis manual and the "Getting Started" 
chapter of this manual. 
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Installing the 
Target System 
Probe 



The 70136 emulator probe has a 68-pin PLCC connector; 

the 70236 and 70236A emulator probe has a 132-pin PGA connector. 



Caution ■ observe these precautions to avoid emulator 

■ CIRCUIT damage. Take the following precautions while using 

the 70136 emulator. 



Power Down Target System. Turn off power to the user target 
system and to the 70136 emulator before inserting the user plug to 
avoid circuit damage resulting from voltage transients or mis-insertion 
of the user plug. 

Verify User Plug Orientation. Make certain that Pin 1 of the target 
system microprocessor socket and Pin 1 of the user plug are properly 
aligned before inserting the user plug in the socket. Failure to do so 
may result in damage to the emulator circuitry. 

Protect Against Static Discharge. The 70136 emulator contains 
devices which are susceptible to damage by static discharge. 
Therefore, take precautions before handling the user plug to avoid 
emulator damage. 

Protect Target System CMOS Components. If your target system 
includes any CMOS components, turn on the target system first, then 
turn on the 70136 emulator. When powering down, tum off the 
emulator first, then tum off power to the target system. 
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Pin Protector 
(70236/70236A 
Emulator Only) 



The target system probe has a pin protector that prevents damage to the 
probe when inserting and removing the probe from the target system 
microprocessor socket. Do not use the probe without a pin protector 
installed. If the target system probe is installed on a densely populated 
circuit board, there may not be enough room for the plastic shoulders 
of the probe socket. If this occurs, another pin protector may be stacked 
onto the existing pin protector. 



Auxiliary Output 
Lines 



Two auxihary output lines, "TARGET BUFFER DISABLE" and 
"SYSTEM RESET", are provided with the 70136 emulator. The 
"TARGET BUFFER DISABLE" output Une is also provided with the 
70236 and 70236A emulator. 



Caution m damage to the emulator probe will result if 

THE AUXILIARY OUTPUT LINES ARE INCORRECTLY 
INSTALLED. 

When installing the auxihary output lines into the end of the emulator 
probe cable, make sure that the ground pins on the auxiliary output 
lines (labeled with white dots) are matched with the ground receptacles 
in the end of the emulator probe cable. 



PROBE CRBLE 



MICROPROCESSOR 
CONNECTOR 



SYSTEM RESET 




TRRGET BUEEER 
BISRBLE 



Figure 3-1. Auxiliary Output Lines (70136 Emulator) 
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TARGET BUFFER DISABLE —This active-high output is used 

when the co-processor memory accesses to emulation memory will be 
operated. This output is used to tristate (in other words, select the high 
Z output) any target system devices on the 70136 data bus. Target 

system devices should be tristated because co-processor memory reads 
from emulation memory will cause data to be output on the user probe. 

This "TARGET BUFFER DISABLE" output will be driven with the 
following timing in the co-processor memory access cycle. 

Tl T2 Tl 
R23-R0 



TRRGET ~— 

BUFFER 
DISRBLE 

The 1 1 me ' t ' is 

26 nsec MIN. 
5G.a nsec MRX. 
(7013G Emul ator) 

2G nsec MIN. 
Gl .8 nsec MRX. 
(70236 Emu 1 ator ) 



SYSTEM RESET (70136 only) —This active-high, CMOS output 
should be used to synchronously reset the emulator and the target 
system. 
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Installing into a 
70136 PLCCType 
Socket 



To connect the microprocessor connector to the target system, 
proceeded with the following instructions. 



■ Remove the 70136 microprocessor (PLCC type) from the 
target system socket. Note the location of pin 1 on the 
microprocessor and on the target system socket. 

■ Store the microprocessor in a protected enviroimient (such as 
antistatic form). 

■ Install the microprocessor connector into the target system 
microprocessor socket. 

X PROBE CHBLE 




MICROPROCESSOR 
CONNECTOR 



PIN 1 OP 

MICROPROCESSOR 

CONNECTOR 



PIN 1 OP 
TRRGET SYSTEM 
MICROPROCESSOR 
SOCKET 



Figure 3-2. Installing into a 70136 PLCC type socket 
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Installing into a 
70136 PGA Type 
Socket 



The 70136 emulator is provided with an AMP 821574-1 socket and a 
pin protector in order to plug into the target system socket of an PGA 
type. You may use this AMP socket with the pin protector to connect 
the microprocessor connector to the target system. 
To connect the microprocessor connector to the target system, 
proceeded with the following instructions. 



Remove the 70136 microprocessor (PGA type) from the target 
system socket. Note the location of pin Al on the 
microprocessor and on the target system socket. 
Store the microprocessor in a protected environment (such as 
antistatic form). 

Place the microprocessor connector with an AMP socket and a 
pin protector (see figure 3-3), attached to the end of the probe 
cable, into the target system microprocessor socket. 



PROBE CPBLE 



PIN HI OF 
MICROPROCESSOR 
CONNECTOR 



PIN PI OP 
TPRGET SYSTEM 
MICROPROCESSOR 
SOCKET 




MICROPROCESSOR 
CONNECTOR 



PIN 1 OF 

MICROPROCESSOR 

CONNECTOR 



RMP PGR SOCKET 
CB21574-1) 



PIN PROTECTOR 



TRRGET SYSTEM 

MICROPROCESSOR 

SOCKET 



Figure 3-3. Installing into a 70136 PGA type socket 
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Installing into a To connect the 70136 emulator microprocessor connector to the 

701 "iR OFP TvnP NEC EV-9200G-74 socket on the target system, you should use the 

/ U I OO r I y pe adapter, HP PART NO. 64756-61612, that wiU allow the PLCC 

Socket imcroprocessor connector to connect to the QFP socket. 



To connect the microprocessor connector to the target system, 
proceeded with the following instructions. 

■ Note the location of pin 1 on the NEC EV-9200G-74 socket 
on the target system. 

■ Place the microprocessor connector with the adapter (see 
figure 3-4), attached to the end of the probe cable, into the 
target system imcroprocessor socket. 

PROBE CRBLE 




MICROPROCESSOR 
CONNECTOR 



PIN 1 OF 

MICROPROCESSOR 

CONNECTOR 
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Installing into a To connect the microprocessor connector to the target system, 

70236/236A PGA proceeded with the following instructions. 

Type Socket 



■ Remove the 70236 or 70236A microprocessor (PGA type) 
from the target system socket. Note the location of pin Al on 
the microprocessor and on the target system socket. 

■ Store the microprocessor in a protected enviroimient (such as 
antistatic form). 

■ Install the microprocessor connector into the target system 
microprocessor socket with a pin protector (see figure 3-5). 



Caution do not use the microprocessor connector without using a pin 

fl| protector. The pin protector is provided to prevent damage to the 

microprocessor connector when connecting and removing the 
microprocessor connector from the target system PGA socket. 



Installing into a To coimect the 70236 or 70236A emulator microprocessor connector to 
TflPlfi/Tn^IRA NEC EV-9200GD-120 socket on the target system, you should use 

/ U^OO/ / U^OOM EV-9500GD- 120 adapter that will allow the PGA 

QFP Type Socket microprocessor connector to connect to the QFP socket. 
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SOCKET 

Figure 3-5. Installing into a 70236 PGA type socket 
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In-Circuit 

Configuration 

Options 



The 70136 emulator provide configuration options for the following 
in-circuit emulation issues. Refer to the chapter on "Configuring the 
Emulator" for more information on these configuration options. 



Using the Target The default 70136, 70236 and 70236A emulator configuration selects 
System Clock Source the internal I6 MHz (system clock speed) clock as the emulator clock 

source. 

You should configure the emulator to select an extemal target system 
clock source for the "in-circuit" emulation. 



Allowing the Target 
System to Insert Wait 
States 



High-speed emulation memory provides no-wait-state operation. 
However, the emulator may optionally respond to the target system 
ready line while emulation memory is being accessed. 



Note Hfl When you use the NEC uPD72291 coprocessor on your target system 

connected to 70 1 36 microprocessor, the uPD7229 1 can access 70136 
emulation memory on coprocessor memory read/write cycles. 

In this case, you should reset the target system to connect the 70136 
emulator to the uPD72291 coprocessor before starting emulation 
session. 



Enabling NMI and You can configure whether the emulator should accept or ignore the 
RESET Input from NMI and reset signals from the target system. 

the Target System 
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Running the 
Emulator from 
Target Reset 



You can specify that the emulator begins executing from target system 
reset. When the target system RESET line becomes active and then 
inactive, the emulator will start reset sequence (operation) as actual 
microprocessor. 



At First, you must specify the emulator responds to RESET signal by 
the target system (see the "Enable RESET Input From Target?" 
configuration in Chapter 4 of this manual). 

To specify a run from target system reset, select: 
Processor Go Reset <RESET> 



The status now shows that the emulator is "Awaiting target reset" . 
After the target system is reset, the status Une message wiU change to 
show the appropriate emulator status. 
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Pin State in 

Background 

(70136) 



While the emulator is running in the background monitor, probe pins 
are in the following state. 



Address Bus Same as foreground 

Data Bus Always high impedance except accessing target. 

When accessing target by background monitor, 
same as foreground. 

RAV,M/IO Always high level except accessing target. When 

BUSSTO accessing target by background monitor, same as 

foreground. 

BUSSTl Always low level except accessing target. When 

accessing target by background monitor, same as 
foreground. 



Other 



Same as foreground 
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Pin State in 

Background 

(70236/70236A) 



While the emulator is running in the background monitor, probe pins 
are in the following state. 



Address Bus 
Data Bus 

R/W,M/K), 
lORDJOWR, 
MWR 



MRD 



Same as foreground 

Always high impedance except accessing target. 
When accessing target by background monitor, 
same as foreground. 

Always high level except accessing target. When 
accessing target by background monitor, same as 
foreground. 

Same as foreground except for emulation memory 
write. When accessing emulation memory write, 
low. 



Other 



Same as foreground 
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Target System 

Interface 

(70136) 



RAVM/IO 
BUSST2-1 



A23-A0 
UBE 



These singals are connected to 70136 through 
FCT257 and lOK ohm pull-up register. 



R/W,M/10 
BUSST2-1 





7013B 




FCT257 











These singals are connected to 70136 through 
FCT244 and lOK ohm pull-up register. 



10K 



R23-R0 
UBE 





7013B 


] 


FCT244 
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BC YST DSTB These singals are connected to 70136 through 

19.6 ohm. 



BCYST.nSTB 



19. B 



D15-D0 



These singals are connected to 70136 through 
FCT245 and lOK ohm pull-up register. 



+5V 



D15-D0 





7013B 


1 ] 


FCT245 











READY 
BS8/BS16 



These singals are connected to 70136 through 
GAL and lOK ohm pull-up register. 



RERDY,BSB/BS1E 







7013G 


E 1 


GRL 


»- 
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HLDRQ 
NMI 
RESET 



These singals are connected to 70136 through 
ACT14 and 4.7K ohm pull-up and lOK ohm 
puU-down registers. 







70136 


HLDRQ, NMI 




RCTH 




RESET 






^ 10K 






OTHER 



These singals are connected to 70136 through 
FCT244 and 4.7K ohm pull-up and lOK ohm 
puU-down registers. 







ECT244 
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Target System 

Interface 

(70236/70236A) 

R/WM/IO These singals are connected to 70236/70236A 

lORDIOWR through FCT257 and lOK ohm pull-up register. 

MRDMWR 
BUSST2-0 



+5V 



R/H,M/10 
lORD, lOHR 
MRD.MWR 
BUSST2-0 







70236 


1 


FCT257 













OTHER(INPUT) These singals are connected to 70236/70236A 
through FCT244 and lOK ohm pull-up register. 



10K 



OTHER 







7023B 


1 


FCT244 
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D15-D0 



These singals are connected to 70236/70236A 
through FCT245 and lOK ohm pull-up register. 



+5V 



D15-D0 





7023B 


3 1 


FCT245 











READY 
BS8/BS16 



These singals are connected to 70236/70236A 
through GAL and lOK ohm pull-up register. 



REHDY,BSB/BS1E 







7023B 


E 1 


GRL 


»- 











OTHER(OUTPUT) 



These singals are connected to 70236/70236A 
through FCT244 and 4.7K ohm pull-up and 
lOK ohm pull-down registers. 



4 



Configuring the 70136 Emulator 



Introduction Your 70136 emulator can help you in all stages of target system 

development. For instance, you can run the emulator out-of -circuit 
when developing target system software and in-circuit when 
integrating software with hardware. You can use the emulator's 
internal clock or your target system clock. Emulation memory can be 
used with your target system memory, and it can be mapped as RAM 
or ROM. You can execute your target programs in real-time or allow 
emulator execution to be diverted into the monitor when commands 
request access of target system resources (target system memory, 
register contents, etc.) 

The emulator is a versatile instrument and may be configured to suit 
your needs at any stage of the development process. This chapter 
describes the emulator configuration options. 

This chapter will: 

■ Show you how to access the emulator configuration options. 

■ Describe the emulator configuration options. 

■ Show you how to save a particular emulator configuration, 
and load it again at a later time. 
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Pr6r6C|U iSit6S Before performing the tasks described in this chapter, you should be 

familiar with how the emulator operates in general. Refer to the HP 
64700 Emulators: Concepts of Emulation and Analysis manual and the 
"Getting Started" chapter of this manual. 



Accessing the 
Emulator 
Configuration 
Options 



Select: 

Config, General 

When you position the cursor to a configuration item, a brief 
description of the item appears at the bottom of the display. 



-General Enulation Configuration- 



Internal clock |1!1J Real-tiiie node 

SoFtuare brkpoints |QJ CMB interaction 

Target RESET [Q] Lock RDV signal 

AEX through to target [Jj] uPD72231 FPU 



[QJ Break on ROM urites QCl] 
IQJ Target interrupts Ul] 
Read PGR registers [jffl 
miJ 2B bit address node [Q| 



Bus sizing signal for Bnul_nBM ->^^] Bus sizing signal for target nen-> 3?M 
Seg: off translation Method CTO???! Background Honitor location 
Monitor type 



background 



BBffaee 



<-ti-> :Interfield Nouenent Ctrl <~> : Field editing 



TAB : Scroll choices 



STATUS: N70136— Enulation reset Enulation trace halted 

Uhen ' ijes' is selected, the address in the absolute file is assuned as Z8 bit 

phijsical. OtheruisBj it is considered as 24 bit extended. 



Figure 4-1. General Emulator Configuration (70136) 
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-General Enulatlon Configuration- 



Internal clock IBM Real-tine node 

Software brkpoints |Q| CUB interaction 

Target RESET |Q| Lock RDV signal 

AEX through to target |Q| uPD7Z29i FPU 

Release bus by HOLD [Q] Trace DMA circles 

Uait count of DMA [s| DMA cycle in backgrind[^ Trace dunny HALTACK [Q] 
Bus sizing signal for enul_MeM ->^Q] Bus sizing signal for target_MeM->[QJ 
Segtoff translation nethod ^^^^ Background Monitor location 



Break on ROM urites 
Target interrupts 
Read PGR registers 
20 bit address Mode 
IBIJ Trace refresh ctjcles ffill 



background 



Monitor type 

4-ti-» :lnterfield nouenent Ctrl *~* : Field editing 



B8ffBBe 



T(4B : Scroll choices 



STATUS: N7e236— EMulation reset EMulation trace halted 

Uhen ' yes' is selectedj the enulator uses the internal clock in enulation pod. 

OtheruisBj the clock input froM the target systeM clocks the enulator. 



Figure 4-2. General Emulator Configuration (70236) 



Not© You can use the System Terminal window to modify the emulator 

configuration. If you do this, some PC Interface features may no 
longer work properly. We recommend that you modify the emulator 
configuration using only the PC Interface. 
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Internal Clock 



This configuration item allows you to select whether the emulator will 
be clocked by the internal clock source or by a target system clock 
source. 



Yes Selects the internal clock oscillator as the emulator 

clock source. 

The internal clock speed of the 70136, 70236 and 
70236A are 16 MHz (system clock). This is the 
default. 

No An external target system clock is the emulator 

clock source. 

In the 70136 emulator, external clock sources must 
be within the range of 2-16 MHz. 

In the 70236 emulator, external clock sources must 
be within the range of 4-32 MHz. 

In the 70236A emulator, external clock sources 
must be within the range of 4-40 MHz. 

Note When the 70136 emulator is plugged into the target system, you should 

use the external target system clock source to synchronize the emulator 
with the target system. 



Note 




Changing the clock source drives the emulator into the reset state. 
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Real-Time Mode The "Real-Time mode" question lets you configure the emulator to 

refuse commands that cause an emulator break to monitor during user 
program runs. 

No All commands, whether or not they require a break 

to the emulation monitor, are accepted by the 
emulator. 

Yes When runs are restricted to real-time and the 

emulator is running the user program, all 
commands that cause a break (except "Processor 
Reset", "Processor Break", "Processor Go", and 
"Processor Step") are refused. For example, the 
following commands are not allowed when runs are 
restricted to real-time: 

■ Display/modify registers. 

■ Display/modify target system memory. 

■ Display/modify VO. 



CSUtion Bj Restrict emulator to real-time runs with certain target systems. If your 
™ target system circuitry depends on constant program execution, you 

should restrict the emulator to real-time runs. This helps avoid target 
system damage. Remember that you still can execute the "Processor 
Reset", "Processor Break", and "Processor Step" commands. You 
should use caution when executing these commands. 



NotG I When program execution should take place in real-time and the 



1^ 



emulator should break to the monitor to read page registers (refer to 
"Read PGR registers" section in this chapter), the following commands 
are not allowed with using physical or <segment>:<offset> address 
expression. 

■ Display/modify emulation memory. 
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This question allows you to specify that the emulator break to the 
monitor upon attempts to write to memory space mapped as ROM. The 
emulator will prevent the processor from writing to memory mapped as 
emulation ROM. It cannot prevent writes to target system RAM 
locations mapped as ROM, though the write to ROM break is enabled. 

Yes Causes the emulator to break into the emulation 

monitor whenever the user program attempts to 
write to a memory region mapped as ROM. 

No The emulator will not break to the monitor upon a 

write to ROM. 



Note 




The wrrom analysis specification status option allows you to use write 
to ROM cycles as trigger and storage qualifiers. 



This question allows you to enable or disable the software breakpoints 
feature. 

When you define (add) a breakpoint, software breakpoints are 
automatically enabled. 

No The software breakpoints feature is disabled. This 

is the default emulator configuration, so you must 
change this item before you can use software 
breakpoints. 

Yes Allows you to use the software breakpoints feature. 

The emulator detects the breakpoint interrupt 
instruction (Fl hex), it generates a break to 
background request which as with the "processor 
break" command. 



Break on ROM 
Writes 



Software 
Breakpoints 
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When you define or enable a software breakpoint to a specified 
address, the emulator will replace the opcode with one of 70136 
undefined opcode (Fl hex) as breakpoint interrupt instruction. When 
the emulator detects the breakpoint interrupt instruction (Fl hex), user 
program breaks to the monitor, and the original opcode will be 
replaced at the software breakpoint address. A subsequent run or step 
command will execute from this address. 

Since the system controller knows the locations of defined software 
breakpoints, it can determine whether the breakpoint interrupt 
instruction (Fl hex) is a software breakpoint or opcode in your target 
program. 

If it is a software breakpoint, execution breaks to the monitor,and the 
breakpoint interrupt instruction is replaced by the original opcode. A 
subsequent run or step command will execute from this address. 

If it is an opcode of your target program, execution still breaks to the 
monitor, and an "Undefined software breakpoint" status message is 
displayed. 

Refer to the "Getting Started" for information on using software 
breakpoints. 



Configuring tlie 701 36 Emulator 4-7 



CMB Interaction Coordinated measurements are measurements made synchronously in 

multiple emulators or analyzers. Coordinated measurements can be 
made between HP 64700 Series emulators that communicate over the 
Coordinated Measurement Bus (CMB). 

Multiple emulator start/stop is one type of coordinated measurement. 
The CMB signals READY and /EXECUTE are used to perform 
multiple emulator start/stop. 

This configuration item allows you to enable/disable interaction over 
the READY and /EXECUTE signals. (The third CMB signal, 
TRIGGER, is unaffected by this configuration item.) 

No The emulator ignores the /EXECUTE and READY 

lines, and the READY line is not driven. 

Yes Multiple emulator start/stop is enabled. If you enter 

the 

Processor, CMB, Go, . . . 

command, the emulator will start executing code 
when a pulse on the /EXECUTE line is received. 
The READY line is driven false while the emulator 
is running in the monitor. It goes true whenever 
execution switches to the user program. 



Note 




CMB interaction also will be enabled when you enter the 



Processor, CMB, Execute 
command. 
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Target Interrupts 



This configuration option specifies whether or not the emulation 
processor accepts to NMI signal generated by the target system. 



Yes The emulator accepts NMI signal generated by the 

target system. When the NMI signal is accepted, 
the emulator calls the NMI procedure as actual 
microprocessor. 

No The emulator ignores NMI signal from target 

system completely. 



Note 



You should not use "Processor Step" command if target system can 
generates NMI. 

When the emulator accepts NMI input in stepping, the following error 
message will be shown. 

ERROR : Stepping failed 

In this case, you should configure that the emulator ignores NMI input 
from the target system with this configuration. 
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Target RESET The 70136 emulator can respond or ignore target system reset while 

running in user program or waiting for target system reset (refer to 
"Processor Go Reset" command in "In-circuit Emulation" chapter). 
While running in background monitor, the 70136 emulator ignores 
target system reset completely independent on this setting. 



Yes Specify that, this is a default configuration, make 

the emulator to respond to reset from target system. 
In this configuration, emulator will accept reset and 
execute from reset vector (OFFFFO hex) as same 
manner as actual microprocessor after reset is 
inactivated. 



No If disabled, the emulator completely ignores the 

reset signal from target system. This is true if the 
emulator is in foreground (executing user program). 



Lock RDY Signal High speed emulation memory provides no- wait- state operation. 

However, the emulator may optionally respond to the target system 
ready lines while emulation memory is being accessed. 



No When the ready relationship is not locked to the 

target system, emulation memory accesses ignore 
ready signals from the target system (no wait states 
are inserted). 

Yes When the ready relationship is locked to the target 

system, emulation memory accesses honor ready 
signals from the target system (wait states are 
inserted if requested). 
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Read PGR This configuration item allows you to specify whether the emulator 

Rpni^tPrQ should break to the monitor to read page registers or whether the 

" emulator should use the copy of page registers when the emulation 

system will convert logical address to extended address in the 

following commands. 



■ Display/modify memory with entering physical, 

<SEGMENT>:<OFFSET>, or no function code address 
expression. 



■ Modify software breakpoints. 

Yes Specifies that the emulator should break to the 

monitor to get the current value of page registers on 
accesses to emulation/target memory. 



No Specifies that the emulator should use the copy of 

page registers which is renewed at breaking to the 

monitor or changing the value of page registers 
with using the following PC Interface command. 
Register Modify <pgr 1 . . pgr 64> 

You should select this configuration when you only 
use the normal address mode in your program or 
the value of page registers is not changed after 
initializing while executing your program. 
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AEX Through to 
Target 



This configuration option allows you to select the AEX (Address 
Extension) signal level which is driven to the target system while in the 
background monitor cycles. 



Yes Specifies that the emulator will drive the AEX 

signal with the level dependent on the address mode 
in background monitor cycles. When you use the 
extended address in an emulation command, the 
AEX signal will be driven to high level in 
background monitor. 

No Specifies that the emulator will hold the AEX 

signal with the level dependent on the last 
foreground address mode just before entering 
background monitor. When the program is running 
on normal address mode, the emulator will hold the 
AEX signal level low in background monitor. 



UPD72291 FPU This configuration option allows you to select the assembler 

mnemonics for FPU (Floating Point Unit) to display memory. 

Yes Specifies that mnemonics for NEC uPD7229 1 

floating point processor will be used to display 
memory. 

No Specifies that mnemonics for Intel 80287 numeric 

processor extension wiU be used to display memory. 
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20 Bit Address This configuration option allows you to specify the load address of an 

MnH^ absolute file in "Memory Lord" command. 



No Specify that the emulator will interpret address in 

absolute file as 24-bit extended address. 

Yes Specifies that the emulator will interpret address in 

absolute file as 20-bit physical address. 



Release bus by (70236/70236A Emulator only) This configuration allows you to 

|_jQ ^ Q specify whether or not the emulator accepts HLDRQ (Hold Request) 

signal generated by the target system in background. 



No The emulator ignores HLDRQ signal from target 

system completely in background. 

Yes The emulator accepts HLDRQ signal. When the 

HLDRQ is accepted, the emulator will respond as 
actual microprocessor. 



Trace DMA Cycles (70236/70236A Emulator only) This question allows you to specify 

whether or not the analyzer trace the emulation processor's internal 
DMA cycles. 

Yes Specifies that the analyzer will trace the internal 

DMA cycles. 

No Specifies that the analyzer will not trace the 

internal DMA cycles. 
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Trace Refresh 
Cycles 



(70236/70236A Emulator only) This question allows you to specify 
whether or not the analyzer trace the emulation processor's refresh 
cycles. 



Yes Specifies that the analyzer will trace the refresh 

cycles. 

No Specifies that the analyzer will not trace the refresh 

cycles. 



Wait count of DMA (70236/70236A Emulator only) When you want to ti-ace internal 

DMA cycles correctly with using the emulator, you must set the 
number of wait count for internal DMA cycles. 

The number is the same as the value of DMAW (Wait for the DMA 
cycle) of the WCY4 (programmable wait, cycle 4) register (I/O address 
FFF6 hex). See the "Trace DMA Cycles" in tiiis chapter. 



DMA cycle in (70236/70236A Emulator only) This configuration allows you to 

RrloknrniinH specify whether or not the emulation processor's internal DMA is 

" allowed while in background. 



Yes The internal DMA is allowed while in background. 

No The internal DMA is not allowed while in 

background. 
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Trace Dummy 
HALTACK 



(70236 Emulator only) This question allows you to specify whether 
or not the analyzer trace the emulation processor's dummy HALT 
acknowledge cycles. 



Whenever breaks occur during the emulation processor is HALTed, the 
HALT acknowledge cycle will be occurred one more time. This 
configuration specifies that the analyzer trace or not this HALT 
acknowledge cycles. 

No Specifies that the analyzer will not trace the dummy 

HALT acknowledge cycles. 

Yes Specifies that the analyzer will trace the dummy 

HALT acknowledge cycles. 



Bus Sizing Signal 
for Emul_mem 

emul Specifies that the bus size of emulation memory is 

selected from the setting of the map configuration. 
Refer to the "Mapping Memory" command 
description in "Using the Emulator" chapter. 

tg^ Specifies that the bus size of emulation memory is 

defined from the BS8/BS16 input of the target 
system. 
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Bus Sizing Signal 
for Target_mem 



tgt Specifies that the bus size of target memory is 

defined from the BS8/BS16 input of the target 
system. 



emul Specifies that the bus size of target memory is 

selected from the setting of the map configuration. 
Refer to the "Mapping Memory" command 
description in "Using the Emulator" chapter. 



Not© Ma The data bus size of I/O accesses is only defined from the BS8/BS16 

input of the target system. 
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The run and step commands allow you to enter addresses in either 
logical form (segment: offset, e.g., OFOOOH:OOOOH) or physical form 
(e.g., OFOOOH). When a physical address (non-segmented) is entered 
with either a run or step command, the emulator must convert it to a 
logical (segment: offset) address. 



Seg:off 
Translation 
Method 

minseg 

logical_addr = ( (phys_addr » 4) & OxfOOO) 

maxseg 



Specifies that the physical run address is converted 
such that the low 16 bits of the address become the 
offset value. The physical address is right-shifted 4 
bits and ANDed with OFOOOH to yield the segment 
value. 



Specifies that the low 4 bits of the physical address 
become the offset. The physical address is 
right-shifted 4 bits to yield the segment value. 



les that the value entered with either a run or 
step command (0 thru Offff hex) becomes the offset. 
In this selecting, the current segment value is not 
changed. 



logical_addr = (phys_addr >> 4) : (phys_addr & Oxf) 

curseg Speci 



: (phys_addr & Oxffff ) 



logical_addr = {current segment) : (entered value) 

If you use logical addresses other than the three methods which follow, 
you must enter run and step addresses in logical form. 
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Background 
Monitor Location 



You can relocate the monitor from the default monitor location to any 
4K byte boundary. When entering monitor block addresses, you must 
only specify addresses on 4K byte boundaries; otherwise, an invalid 
syntax message is displayed. The location of background monitors 
may be important because background cycles of the 70136 emulator 
can be visible to the target system. 

In default, the monitor is located on OFFOOO hex through OFFFFF hex. 



Note 



4 



If your target system have some circuitry which monitors bus activities 
to detect illegal access to resources, You may need to relocate monitor 
address. 



l\/lonitor Type 



This configuration option allows you to select and use a foreground 
emulation monitor program. The default monitor is background 
monitor. 



Note 



1^ 



Halt instructions will cause "processor halted" emulation status. 

In this status, the emulator cannot break to the monitor. 

In this case, you should enter the "reset" command to reset the 
emulator first. 



background Specify monitor type as background monitor. 

When you select background monitor, you can 
specify the background monitor location. 
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While running in background monitor, the 70136 emulator ignores 
target system reset. 



foreground Specify monitor type as foreground monitor. When 
you select foreground monitor, you must specify 
correct foreground monitor start address with next 
configuration question (foreground monitor 
address). After you completed the configuration 
setting, you need to load foreground monitor 
program to the emulator with "Memory, Load" 
feature. The foreground monitor program must 
already assembled and Unked with appropriate 
location specification. Refer to the HP 64756 
70136 Emulator Terminal Interface User's Guide 
for more information. 



You must not use the foreground monitor if you wish to perform 
coordinated measurements. 



If you select a foreground monitor, a 4 kilobyte block is automatically 
mapped at the address specified by the next question. 
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Foreground 
Monitor Address? 



The location of the foreground monitor is important because it will 
occupy part of the processor address space. Foreground monitor 
location must not overlap the location of target system programs. The 
default foreground monitor location is "OFOOOOH". 

When entering monitor block addresses, you must only specify 
addresses on 4K byte boundaries; otherwise, an invalid syntax message 
is displayed. 



Note 




Relocating the monitor causes all memory mapper terms to be removed. 



1^ 



Not© I You should not load the foreground monitor provided with the 70136 

emulator at the base address 0 or OffOOO hex; the 70136 
microprocessor's vector table is located. 

And, You can not load the foreground monitor at the base address over 
100000 hex. 
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storing an 

Emulator 

Configuration 



The PC Interface lets you store a particular emulator configuration so 
that it may be re-loaded later. The following information is saved in the 
emulator configuration. 



■ Emulator configuration items. 

■ Key macro specifications. 

■ Memory map. 

■ Break conditions. 

■ Trigger configuration. 

■ Window specifications. 

To store the current emulator configuration, select: 
Config, Store 

Enter the name of a file in which to save the emulator configuration. 



Load i n g an if you want to reload a previously stored emulator configuration, select: 

Emulator 
Configuration 

Config, Load 

Enter the configuration file name and press Enter. The emulator will 
be reconfigured with the values specified in the configuration file. 
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Notes 
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5 



Using the Emulator 



Introduction In the "Getting Started" chapter, you learned how to use the basic 

features of the 70136 emulator. This chapter describes the more 
in-depth features of the emulator. 

This chapter shows you how to: 

■ Address syntax in emulation commands. 

■ Address expression in emulation commands. 

■ Register names and classes. 

■ Make coordinated measurements. 

■ Store the contents of memory into absolute fUes. 
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Address Syntax 

Syntax 





< SEGMENT > 









<EXT RDDR> 



The address used in emulation commands may be specified as a 
segment: offset address, physical address, or as an extended address 
(though a physical address in run commands (see table 5-1) is 
converted to a <segment>:<offset> address and a extended address in 
memory commands (see table 5-1) is converted to a value of the page 
register and a <segment>:<offset> address by the emulation system). 

The physical and extended address specifications are of the following 
form. " @e" and " @p" are the function codes to define as an extended 
or a physical address. 

Extended address EXT_ADDR@e 

Physical address PHY_ADDR@p 

Expressions are defined in the HP 64700 Emulators Terminal 
Interface: User's Reference manual. 
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Parameters 

<SEGMENT> 

<OFFSET> 

<PHY_ADDR> 



<EXT_ADDR> 



<I/0_ADDR> 



This expression (0-OFFFF hex) is the segment 
portion of the logical address. The value specified 
is placed in the 70136 PS register. 

This expression (0-OFFFF hex) is the offset portion 
of the logical address. The value specified is placed 
in the 70136 PC register. 

This expression (0-OFFFFF hex) with " @p" 
function code is a physical address in the 70136 
address range. In run commands (see table 5-1), 
the emulation system converts this physical address 
to a <segment>:<offset> address as specified by the 
"Seg:off translation method" configuration option 
in "Configuring the 70136 Emulator" chapter. 

This expression (0-OFFFFFF hex) with " @e" 
function code is a extended address in the 70136 
address range. In memory commands (see table 
5-1), the emulation system converts this extended 
address to a value of the page register and a 
<segment>:<offset> address to access the memory. 

This expression (0-OFFFF hex) with no function 
code is a 70136 I/O address. This expression 
should be used in I/O command (see table 5-1). 
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Address 
Expression 



Table 5-1 is the address expression matrix used in emulation 
commands. 



Table 5-1 . Address expression syntax 



Command 
group 



<EXT_ADDR> 
(@e) 



<PHY_ADDR> 
(@p) 



<SEGMENT> : <OFFSET> 



No function 
code 



Memory commands 



OK 



0K(*1) 



0K(*1) 



same as 
<PHY ADDR> 



Run 

commands 
(*2) 



maxseg 



minseg 



curseg 



ERROR 



OK 



ERROR 



OK 



ERROR 



ERROR 



OK 



OK 



OK 



same as 
<PHY ADDR> 



same as 
<PYH ADDR> 



<OFFSET> 
(0-OFFFFH) 



I/O command 



ERROR 



ERROR 



ERROR 



OK 

(0-OFFFFH) 



Map command 
Breakpoints command 



OK 
OK 



ERROR 
0K(*1) 



ERROR 
0K(*1) 



same as 
<PHY ADDR> 



*1 : Emulator breaks to the monitor on accesses to emulation memory 

{refer to the "Read PGR registers" in "Configuring the 70136 Emulator" chapter.) 

*2 : Refer to "Seg:off Translation Method" in "Configuring the 70136 Emulator" chapter. 
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MGmory Commands The following commands are included in memory commands. 



Memory, Display 

Memory, Modify 

Memory, Store 

Memory, Copy 

Memory, Find 



You can use the following address expression in memory commands 
(refer to "Read PGR registers" configuration item in "Configuring the 
70136 Emulator" chapter). 



I <EXT_ADDR> I <PHY_ADDR> | <SEGMENT> : <OFFSET> | 

, , I 

Read PGR : YES I OK | OK* | OK* | 

Read PGR : NO I OK 1 OK 1 OK | 



(* - Emulator breaks into the monitor on accesses to emulation memory) 

When you set the emulator to read PGR on address translation, the 
emulator should break to the monitor to get the current value of page 
register on address translation. 

When you set the emulator not to read PGR on address translation, the 
emulator should use the copy of page registers which is renewed at 
breaking to the monitor or changing the value of page registers. In this 
case, the emulator does not break to the monitor. 



4 



Note I You may answer "NO" to "Read PGR registers" configuration item 

when you only use normal address mode in your program or the value 
of page registers is not changed after initializing while executing your 
program. 



Using the Emulator 5-5 



N Ote vp When program execution should take place in real-time (refer to 

"Configuring the 70136 Emulator" chapter) and the emulator should 

break to the monitor to read page registers, the commands showing 
above which need physical to extended address conversion are not 
allowed in running user program. If you entered, the following error 
message will be shown: 

ERROR: Restricted to real time runs 



Load/Dump Address when you download programs into memory using "Memory Load" 

command, the emulator wiU interpret an address in the absolute file 
owing to the following configuration setting (refer to "20 bit address 
mode" configuration item in "Configuring the 70136 Emulator" 
chapter). 



I configuration | address mode I 
I I I 

I 20 bit address mode : no I extended address I 
I 20 bit address mode : yes I physical address I 



When you dump memory to a host file using "Memory Store" 

command, the address information saved to host file is defined from 
the address expression used in the "Memory Load" command. 



1 Address expression 
1 (in dump command) 


address information | 
(to a host file) I 


<EXT_ADDR> ("@e") 
1 <PHY_ADDR> ("@p") 
1 <SEGMENT>:<OFFSET> 
1 No function code 


extended address 
physical address 1 
physical address I 
physical address I 



Not© Mil When you download the host file made by "Memory Store" command 

before, you should set the same "Address mode for file loading" 
configuration item that you enter the "Memory Store" command. 
Otherwise, the memory image is not the same as when you enter the 
"Memory Store" command to make the host file. 
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N Ot© When you download the host file with physical address infomation 

" made by "Memory Store" command, you should set up the same value 
to page registers ( PGR 1 - PGR 64 ) that you enter the "Memory 
Store" command. Otherwise, the memory image is not same as when 
you enter the "Memory Store" command to make the host file. 



Run CommdndS The following commands are included in run commands. 

Processor, Go, Address 
Processor, CMB, Go, Address 
Processor, Step, Address 

You can use the following address expression in run commands. 



(refer to "Seg:off translation method" configuration item in 
"Configuring the 70136 Emulator" chapter) 









<EXT_ADDR> 


<PHY_ADDR> 


<SEGMENT> : <OFFSET> 


No function code I 


Seg 


off 


maxseg 


ERROR 


OK 


OK 


SAME AS <PHY_ADDR> 


Seg 


off 


minseg 


ERROR 


OK 


OK 


SAME AS <PHY_ADDR> | 


Seg 


off 


curseg 


ERROR 


ERROR 


OK 


<OFFSET> 1 



You should not use the extended address expression in run commands. 

If you use extended address expression, the following error messages 
win be shown. 

ERROR: Extended address can not be used 



Using the Emulator 5-7 



I/O Command 



The following command is included in I/O command. 



Processor, I/O 



You can only use the I/O address expression ; this expression (0-Offff 
hex) with no function code defines a 70136 I/O address. 



Note S You should not access 70136 page registers (PGR 1 - PGR 64) with 

" using "Processor, I/O" command. You should use "Register" command 

to access page registers. 



Map Command The following command is included in map command. 

Config, Map, Modify 

You can only use the extended address expression ; this expression 
(0-Offffff hex and with "@e" function code) defines a 70136 extended 
address. 

Dof inG thG data bus The data bus size for memory accesses can be defined in map 

size command. For example, enter the following command to map memory 
(The extended address expression should be used in map command). 

Config, Map, Modify 

Using the arrow keys, move the cursor to the "Address range" field of 
term 1. Enter: 

0. .7ff@e 

Move the cursor to the "Memory type" field of term 1 , and press the 
TAB key to select the erom (emulation ROM) type. Move the cursor 
to the "Bus size" field of term 1, and enter "16" to map this emulation 
ROM with 16-bit data bus. Move the cursor to the "address range" 
field of term 2 and enter: 

800. . 9ff@e 
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Move the cursor to the "memory type" field of term 2, and press the 
TAB key to select the eram (emulation ROM) type. Move the cursor 
to the "Bus size" field of term 2, and enter "8" to map this emulation 
RAM with 8-bit data bus. 



To save your memory map, use the right arrow key or the Enter key to 
exit the field in the lower right corner. (The End key on Vectra 
keyboards moves the cursor directly to the last field.) The memory 
configuration display is shown in below. 



nenory Map Configuration — 

UnMapped nenory type [^^^ 
flddress Range 



: Field editing 




Menory T 




eroM 




eran 




grd 




grd 




grd 




grd 




grd 




grd 




grd 




grd 




grd 




grd 




grd 




grd 




grd 




grd 



TPS : Scroll choices 



status: N70Z36— EMulation reset 



EMulation trace halted 



Use the TAB and Shift-TAB keys to pick bus size for Mapped range. 



The other memory ranges are mapped as target RAM with 16-bit data 
bus (if the data bus size is not specified in map command, the address 
ranges will be mapped with 16-bit data bus by default). 



Not© The data bus size for memory accesses also can be defined from the 

BS8/BS16 input of the target system. 

Refer to "Bus size signal for emulation/target memory" configuration 
items in "Configuring the 70136 Emulator" chapter. 
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Note 



4 



Th e data bus size of I/O accesses (external I/O only) is defined from 
the BS8/BS16 input of the target system. 



Breakpoints The following commands are included in breakpoints command. 

Command 

Breakpoints 

You can use the following address expression in breakpoints command 
(refer to "Read PGR registers" configuration item in "Configuring the 
70136 Emulator" chapter). 



I <EXT_ADDR> I <PHY_ADDR> | <SEGMENT> : <OFFSET> | 



■I 



Read PGR 
I Read PGR 



YES 
NO 



OK 
OK 



OK* 
OK 



OK* 
OK 



Emulator breaks into the monitor on accesses to emulation memory) 

When you set the emulator to read PGR on address translation, the 
emulator should break to the monitor to get the current value of page 
register to convert logical address to extended address using in 
emulation system. 

When you set the emulator not to read PGR on address translation, the 
emulator should use the copy of page registers which is renewed at 
breaking to the monitor or changing the value of page registers. In this 
case, the emulator does not break to the monitor. 



Note 



4 



You may answer "NO" to "Read PGR registers" configuration item 
when you only use normal address mode in your program or the value 
of page registers is not changed after initializing while executing your 
program. 
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REGISTER 
NAMES and 
CLASSES 
(70136 Emulator) 



The following register names and classes are used with the "Register 
Display/Modify" commands in 70136 emulator. 



BASIC(*) class 



NOCLASS 



Register name Description 

aw, bw BASIC registers, 

cw, dw 
bp, ix, iy 
dsO, dsl, ss 
sp, pc, ps, psw 



Register name Description 

al, ah, bl, bh 
cl, cli, dl, dli 



PGR class (page registers) 



Register name Description 



pgrl 
pgr2 



PGR 1 register 
PGR 2 register 



pgr63 
pgr64 
xam 



PGR 63 register 
PGR 64 register 
XAM register (Read only) 
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REGISTER 
NAMES and 
CLASSES 
(70236/70236A 
Emulator) 

BASIC(*) class 



NOCLASS 



PGR class 



The following register names and classes are used with the "Register 
Display/Modify" commands in 70236 emulator. 



Register name 

aw, bw 
cw, dw 
bp, ix, iy 
dsO, dsl, ss 
sp, pc, ps, psw 



Description 

BASIC registers. 



Register name Description 

al, ah, bl, bh 
cl, ch, dl, dh 

(Page registers) 



Register name Description 



pgrl 
pgr2 



PGR 1 register 
PGR 2 register 



pgr63 
pgr64 
xam 



PGR 63 register 
PGR 64 register 
XAM register (Read only) 
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SIO class (System I/O registers) 



Register name 


Description 


bsel 


Bank selection register 


badr 


Bank address register 


brc 


Baud rate counter 


wmbO 


Programmable wait, memory boundary 0 register 


wcyl 


Programmable wait, cycle 1 register 


wcyO 


Programmable wait, cycle 0 register 


wac 


Programmable wait, memory address control 




register 


tcks 


Timer clock selection register 


sbcr 


Stand-by control register 


refc 


Refresh control register 


wmbl 


Programmable wait, memory boundary 1 register 


wcyl 


Programmable wait, cycle 2 register 


wcy3 


Programmable wait, cycle 3 register 


wcy4 


Programmable wait, cycle 4 register 


sula 


SCU low address register 


tula 


TCU low address register 


iula 


ICU low address register 


dula 


DMAU low address register 


opha 


On-chip peripheral high address register 


opsel 


On-chip peripheral selection register 


sctl 


System control register 
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ICU class 



(Interrupt Control Unit registers) 



Register name Description 

imkw Interrupt mask word register 

irq Interrupt request register (Read only) 

iis Interrupt in-service register (Read only) 

ipol Interrupt polling register (Read only) 

ipfw Interrupt priority and finish word register 
(Write only) 

imdw Interrupt mode word register (Write only) 

iiwl Interrupt initialize word 1 register (Write only) 

iiw2 Interrupt initialize word 2 register (Write only) 

iiw3 Interrupt initialize word 3 register (Write only) 

iiw4 Interrupt initialize word 4 register (Write only) 



Caution 




When ipol register is displayed, interruptis are suspended until the FI 
command is published. 



TCU class (Timer Control Unit registers) 



Register name Description 

tctO Timer/counter 0 register 

tstO Timer status 0 register (Read only) 

tctl Timer/counter 1 register 

tstl Timer status 1 register (Read only) 

tct2 Timer/counter 2 register 

tst2 Timer status 2 register (Read only) 

tmd Timer/counter mode register (Write only) 
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SCU class (Serial Control Unit registers) 



Register name Description 

srb Serial receive data buffer (Read only) 

sst Serial status register (Read only) 

stb Serial transmit data buffer (Write only) 

scm Serial command register (Write only) 

smd Serial mode register (Write only) 

simk Serial interrupt mask register (Write only) 



DMA71 class (DMA Control Unit registers (for uPD71071 mode) 



Register name Description 

diem DMA initialize register (Write only) 

dch DMA channel register 

dbc/dccO DMA base/current count register channel 0 

dbc/dccl DMA base/current count register channel 1 

dbc/dcc2 DMA base/current count register channel 2 

dbc/dcc3 DMA base/current count register channel 3 

dba/dcaO DMA base/current address register channel 0 

dba/dcal DMA base/current address register channel 1 

dba/dca2 DMA base/current address register channel 2 

dba/dca3 DMA base/current address register channel 3 

dmdO DMA mode control register channel 0 

dmdl DMA mode control register channel 1 

dmd2 DMA mode control register channel 2 

dmd3 DMA mode control register chaimel 3 

ddc DMA device control register 

dst DMA status register (Read only) 

dmk DMA mask register 
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DMA37 class (DMA Control Unit register (for uPD71037 mode) 



Register name 


Description 


cmd 


DMA read status/write command register 


bankO 


DMA bank register channel 0 


bankl 


DMA bank register channel 1 


bank2 


DMA bank register chaimel 2 


bank3 


DMA bank register channel 3 


adrO 


DMA current address register channel 0 


adrl 


DMA current address register channel 1 


adr2 


DMA current address register channel 2 


adr3 


DMA current address register channel 3 


cntO 


DMA current count register channel 0 


cntl 


DMA current count register channel 1 


cnt2 


DMA current count register channel 2 


cnt3 


DMA current count register channel 3 


sfrq 


Software DMA write request register 




(Write only) 


smsk 


DMA write single mask register 




(Write only) 


mode 


DMA write mode register 


clbp 


DMA clear byte pointer F/F (Write only) 


init 


DMA initialize register (Write only) 


cmsk 


DMA clear mask register (Write only) 


amsk 


DMA write all mask register bit (Write only) 
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Making 

Coordinated 

Measurements 



Coordinated measurements are measurements synchronously made in 
multiple emulators or analyzers. Coordinated measurements can be 
made between HP 64700 Series emulators, which communicate over 
the Coordinated Measurement Bus (CMB). Coordinated 
measurements can also be made between an emulator and another 
instrument connected to the BNC connector. 

This chapter will describe coordinated measurements made from the 
PC Interface which involve the emulator. These types of coordinated 
measurements are: 



■ Running the emulator on reception of the CMB /EXECUTE 
signal. 

■ Using the analyzer trigger to break emulator execution into 
the monitor. 



Three signal lines on the CMB are active and serve the following 
functions: 



/TRIGGER Active low. The analyzer trigger hne on the CMB 

and on the BNC serve the same logical purpose. 
They provide a means for the analyzer to drive its 
trigger signal out of the system, or for external 
trigger signals to arm the analyzer or break the 
emulator into its monitor. 



READY Active high. This line is for synchronized, 

multi-emulator start and stop. When you enable 
CMB run control interaction, all emulators must 
break to background on receipt of a false READY 
signal and will not return to foreground until this 
line is true. 



/EXECUTE Active low. This line serves as a global interrupt 
signal. On receipt of an enabled /EXECUTE 
signal, each emulator is to interrupt whatever it is 
doing and execute a previously defined process, 
such as run the emulator or start a trace 
measurement. 
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Running the 
Emulator at 
/EXECUTE 



Before you can specify that the emulator run on receipt of the 
/EXECUTE signal, you must enable CMB interaction. To do this, 
select: 



Config, General 

Use the arrow keys to move the cursor to the "CMB Interaction? [n]" 
question, and type "y". Use the Enter key to exit out of the lower 
right-hand field in the configuration display. 

To begin executing a program on receipt of the /EXECUTE signal, 
select; 

Processor, CMB, Go 

Now you may select either the current program counter ("Pc", in other 
words, the current PS:PC), or a specific address. 

The command you enter is saved, and is executed when the 
/EXECUTE signal becomes active. Also, you will see the message 
"ALERT: CMB execute; run started". 

To break emulator execution into the monitor when the analyzer trigger 
condition occurs, you modify the trigger configuration. To access the 
trigger configuration, select: 

Config, Trigger 

The trigger configuration display contains two diagrams, one for each 
internal TRIGl and TRIG2 signal. 



Breaking on the 
Analyzer Trigger 
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To use the internal TRIGl signal to connect the analyzer trigger to the 
emulator break line, move the cursor to the highlighted "Analyzer" 
field in the TRlGl portion of the display. Use the TAB key to select 

the " »" arrow pointing from the analyzer to TRIGl. Next, move 

the cursor to the highlighted "Emulator" field and use the TAB key to 

select the arrow pointing toward the emulator (« ). This specifies 

that emulator execution will break into the monitor when the TRIGl 
signal is driven. The trigger configuration display appears as follows: 



BNC 



CNB 



Enulator 



(Analyzer' 



— Cross Trigger Configuration 

TRIGl TRIG2 



BNC 



CHB 



Enulator 



Analyzer 



ignore 



<-ti-+ : Interf ield MoueMent Ctrl «— ► : Field editing 



TAB :Scroll choices 



STATUS: N78236— Enulation reset Ehulation trace halted 

The eMulator nay either receiue <« ) or ignore the TRIGl and TRIG2 control 

signals. Upon receipt of TRIGl or TRIG2, the eMulator uill break to background 
Monitor operation. 
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StOri ng Memory The "Getting started" chapter shows you how to load absolute files 

Contents to 3n into emulation or target system memory. You can also store emulation 

or target system memory to an absolute file with the following 

Absolute File command. 



Memory, Store 

When you store memory using "Memory, Store" command, the address 
information saved to an absolute file is defined from the address 
expression used in the "Memory Store" command, refer to "Address 
Expression in Emulation Commands" section in this chapter. 



Not© Hm Th^ first character of the absolute file name must be a letter. You can 

name the absolute file with a total of 8 alphanumeric characters. You 
also can include an extension of up to 3 alphanumeric characters. If 
the file is stored in HP 64000 format, its extension must be ".X". 



Caution mI The "Memory Store" command writes over an existing file if it has the 

same name that is specified with the command. You may wish to 
verify beforehand that the specified filename does not already exist. 
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A 



File Format Readers 



Introduction The 70136 PC Interface is provided with the following "reader". 

■ Intel Object Module Format (OMF86) Reader 

- (This Reader is for the hitel OMF86 absolute file) 

■ NEC30 Reader 

- (This Reader is for the load module format file which is 
generated by NEC LK70136 Unker for uPD70136) 

■ NEC33 Reader 

- (This Reader is for the extended load module format file 
which is generated by NEC EL70136 extended mode 
locator for uPD70136) 



■ HP64000 Reader 



The Reader converts the file(s) into two files that are usable with the 
HP 64756 emulator. This means that you can use available language 
tools to create absolute files, then load those files into the emulator 
using the 70136 PC Interface. 

The Reader can operate from within the PC Interface or as a separate 
process. When operating the Reader, it may be necessary to execute it 
as a separate process if there is not enough memory on your personal 
computer to operate the PC Interface and Reader simultaneously. You 
can also operate the reader as part of a "make fUe". 
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Using the OMF86, 
NEC30, NEC33 
Reader 



What the Reader The Reader accepts as input an absolute file in the form "<file>.<ext>", 
Accomplishes creates two new files that are used by the PC Interface: an 

"absolute" file, and an ASCII symbol file. 



The Absolute File 



During execution of the Reader, an absolute file (<file>.HPA) is 
created. This absolute file is a binary memory image which is 
optimized for efficient downloading into the emulator. 



The ASCII Symbol File 

The ASCII symbol file (<file>.HPS) produced by the Reader contains 
global symbols, module names, local symbols, and, when using 
applicable development tools such as a "C" Compiler, program line 
number. Local symbols evaluate to a fixed (static, not stack relative) 
address. 



Note WA You must use the required options for your specific language tools to 

" include symbolic ("debug") information in the absolute fUe. The 

Reader will only convert symbol information that is present in the input 
absolute file. 
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The symbol file contains symbol and address information in the 
following form: 



inodule_namel 
module_name2 

mo du 1 e_n ameN 

global.symboll 0100:1234 
global_SYmbol2 0100:5678 

global_symbolN 0100:ABCD 

|module_name I # 1234 0200:0872 

I module_naine | local_symboll 0200 : 0653 

|module_name | local_SYinbol2 0200 : 0872 

Imodule name | local_symbolN 0200:0986 

The space preceding module names is required. A single tab separates 
symbol and address. 

Each of the symbols is sorted alphabetically in the order: module 
manes, global symbols, and local symbols. 

The local symbols are scooped. This means that to access a variable 
named "count" in a function named "foo" in a source file module 
named "main.c", you would enter "main.c:foo.count". See table A-1. 

Table A-1 . How to Access Variables 



1 Module 


Name 


Fiinction 


Name 


Variable Name 


1 You 


Enter : | 


1 MAIN 


C 


FOO 




COUNT 


1 MAIN.C 


FOO . COUNT 1 


1 MAIN 


C 


BAR 




COUNT 


1 MAIN.C 


BAR . COUNT 1 


1 MAIN 


c 




line 


number 23 


1 MAIN.C 


line 23 I 



Line numbers will appear similar to a local symbol except that 
"local_symbolX" will be replaced by "#NNNNN" where NNNNN is a 
five digit decimal number. Line numbers should appear in ascending 
order. 
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Note 



When the hne number symbol is displayed in the emulator, it appears 
in brackets. Therefore, the symbol "modname:# 345" will be displayed 
as "modname:[345]" in mnemonic memory and trace Ust displays. 



Location of the 
Reader Program 



Using the Reader 
from l\/IS-DOS 



Line number symbols are accessed by entering the following on one 
line in the order shown: 

module name 
colon (:) 
space 

the word "hne" 
space 

the decimal hne number 

For example: 

MAIN.C: line 23 

The Reader is located in the directory named \hp64700\bin by default, 
along with the PC Interface. This directory must be in the environment 
variable PATH for the Reader and PC Interface to operate properly. 
This is usually defined in the "\autoexec.bat" file. The following 
examples assume that you have "\hp64700\bin" include in your 
PATH variable. If not, you must supply the directory name when 
executing the Reader program. 

The command names for the Reader are shown below. 



Intel OMF86 
Reader 



RDOMF86.EXE 



NEC30 
Reader 



RDNEC30.EXE 



NEC33 
Reader 



RDNEC33.EXE 
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You can execute the Reader from the command Une with the following 

command syntax: 

C: \HP64700\BIN\<READER> [-q] [-u] [-m] 
<filenaine> <RETURN> 

<READER> is the name of the command name for the Reader 

[-q] Specifies the "quiet" mode. This option suppress 

the display of messages. 

[-u] Specifies that the first leading underscore ("_") of a 

symbol is not removed. 

[-m] (RDOMF86.EXE only) Specifies that the OMF86 

Reader removes duplicate module names generated 
by some construction tools. Some tools enclose all 
of the functions and variables in a module within a 
block (or function) whose name is the same as that 
of the module (or source file). When this option is 
used, the Intel OMF86 Reader will ignore the first 
enclosing block in a module is its name matches the 
module name. 

<filename> Specifies the same of the file containing the 

absolute program. You can include an extension in 
the file name. 

The following commands will create the files "TESTPROG.HPA" and 
"TESTPROG.HPS". 

ENTER: RDOMF8 6 TESTPROG.ABS 
ENTER: RDNEC30 TESTPROG.LNK 
ENTER: RDNEC33 TESTPROG.EXL 
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Using the Reader The 70136 PC interface has a file format option under the "Memory 

from the PC Interface Load command. 



After you select OMF86 as the file format, the Intel OMF86 Reader 
will operate on the fUe you specify. After the Reader completes 
successfully, the 70136 PC Interface will load the absolute and symbol 
files produced by the Reader. 

To use the Reader from the PC Interface, follow these steps: 

1. Start up the 70136 PC Interface. 

2. Select "Memory, Load". The memory load menu will appear. 

3. Specify the file format as "OMF86". This will appear as the 
default file format. 

4. Specify the memory to be loaded (emulation, target, or both). 

5. Specify to force the file format reader to regenerate the 
emulator absolute file (.HP A) and symbol database (.HPS) 
before loading the code. Normally, these files are only 
regenerated whenever the file you specify (the output of your 
language tools) is newer than the emulator absolute file and 
symbol database. 

6. Specify that the OMF86 Reader removes duplicate module 
names generated by some construction tools. Some tools 
enclose all of the functions and variables in a module within a 
block (or function) whose name is the same as that of the 
module (or source file). When this option is used, the Intel 
OMF86 Reader will ignore the first enclosing block in a 
module is its name matches the module name. 

7. Specify that the first leading underscore ("_") of a symbol is 
not removed. 
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8. Specify a file in Intel OMF86 format ("TESTFILE.OMF", for 
example). The file extension can be something other than 
".OMF", but ".HPA" or ".HPS" cannot be used. 

Using the Intel OMF86 file that you specify (TESTFILE.OMF, for 
example), the PC Interface performs the following: 

■ It checks to see if two files with the same base name and 
extensions .HPS and .HPA already exist (for example, 
TESTFILE.HPS and TESTFILE.HPA). 

■ If TESTFILE.HPS and TESTFILE.HPA don' t exist, the Mtel 
OMF86 Reader produces them. The new absolute file, 
TESTFILE.HPA, is then loaded into the emulator. 

■ If TESTFILE.HPS and TESTFILE.HPA akeady exist but the 
create dates and times are earlier than the Intel OMF86 file 
creation date/time, the Intel OMF86 Reader recreates them. 
The new absolute file, TESTFILE.HPA, is then loaded into 
emulator. 

■ If TESTFILE.HPS and TESTFILE.HPA akeady exist but the 
dates and times are later than the creation date/time for the 
Intel OMF86 file, the current absolute file, TESTFILE.HPA, 
is then loaded into the emulator. 



Date/time checking only done within the PC Interface. When you run 
the Reader at the MS-DOS command line prompt, the Reader will 
always update the absolute and symbol files. 



When the Reader operates on a tile, a status message will be displayed 
indicating that it is reading an absolute file. When the Reader 
completes its processing, another message will be displayed indicating 
the absolute file is being loaded. 
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Not© When you use NEC33 Reader and load an absolute file, you should 

configure that the emulator interprets address in the absolute file as 
extended address. Refer to "20 Bit Address Mode" section in 

"Configuring the 70136 Emulator" chapter. 



If the RoadGr Won't if your program is very large, the PC Interface may run out of memory 
Run while attempting to create the database file. If this occurs, exit the PC 
Interface and execute the Reader program at the MS-DOS command 
prompt. 



Including Reader in a You may want to incorporate the "RDOMF86", "RDNEC30", or 

Make File "RDNEC33" process as the last step in your "make" file, or as a step in 
your construction process, so as to eliminate the possibility of having to 
exit the PC Interface due to space Umitations describe above. If the file 
with "-.HPA" and "-.HPS" extensions are not current, loading an 
absolute file will automatically create them. 
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Usingthe An hp 64000 "reader" is provided with the PC Interface. The 

HP 64000 R63d6r 64000 Reader converts the files into two files that are usable with 

your emulator. This means that you can use available language tools to 
create HP 64000 absolute files, then load those files into the emulator 
using the PC Interface. 

The HP 64000 Reader can operate from within the PC Interface or as a 
separate process. When operating the HP 64000 Reader, it may be 
necessary to execute it as a separate process if there is not enough 
memory on your personal computer to operate the PC Interface and HP 
64000 Reader simultaneously. You can also operate the reader as part 
of a "make file." 



What the Reader 
Accomplishes 



Using the HP 64000 files (<file.X>, <file.L>, <scrl.A>, <scr2.A>, ...) 
the HP 64000 Reader will produce two new files, an "absolute" file and 
an ASCn symbol file, that will be used by the PC Interface. These new 
files are named: "<file>.hpa" and "<file>.hps." 



The Absolute File 

During execution of the HP 64000 Reader, an absolute file (<file>.hpa) 
is created. This absolute file is a binary memory image which is 
optimized for efficient downloading into the emulator. 



The ASCII Symt)ol File 



The ASCn symbol file (<file>.hps) produced by the HP 64000 Reader 
contains global symbols, module names, local symbols, and, when 
using applicable development tools such as a "C" compiler, program 
line numbers. Local symbols evaluate to a fixed (static, not stack 
relative) address. 
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NotG IB You must use the required options for your specific language tools to 

" include symbolic ("debug") information in the HP 64000 symbol files. 

The HP 64000 Reader will only convert symbol information present in 
the HP 64000 symbol files (<file.L>, <srcl .A>, <src2.A>, ...)• 



The symbol file contains symbol and address information in the 
following form: 



module_namel 
inodule_name2 

module_nameN 
global_symboll 0100:1234 
global_symbol2 0100:5678 

global_symbolN 0100:ABCD 

|module_namel I # 1234 0200:0872 

I module_namel | local_symboll 0200 : 0653 

|inodule_namel | local_symbol2 0200 : 0872 

|module_namel | local_symbolN 0200 : 0986 



Each of the symbols is sorted alphabetically in the order: module 
names, global symbols, and local symbols. 

Line numbers will appear similar to a local symbol except that 
"local_symboK" will be replaced by "#NNNNN" where NNNNN is a 
five digit decimal Une number. The addresses associated with global 
and local symbols are specific to the processor for which the HP 64000 
files were generated. 
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If your emulator can store symbols internally, symbols will appear in 
disassembly. When the Une number symbol is displayed in the 
emulator, it appears in brackets. Therefore, the symbol "MODNAME: 
line 345" will be displayed as "MODNAME: [345]" in mnemonic 
memory and trace hst displays. 



The space preceding module names is required. Although formatted for 
readability here, a single tab separates symbol and address. 

The local symbols are scooped. This means that to access a variable 
named "count" in a source file module named "main.c," you would 
enter "MAIN.C:COUNr' as shown below. 



Table A-2. How to Access Variables 



Module Name 


Variable Name 


You Enter: 


MAIN.C 


COUNT 


MAIN.C iCOUNT 


MAIN.C 


hne number 23 


MAIN.C: hne 23 



You access line number symbols by entering the following on one line 
in the order shown: 

module name 
colon (:) 
space 

the word "line" 
space 

the decimal hne number 

For example: 

MAIN.C: line 23 
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Location of the 
HP 64000 Reader 
Program 



The HP 64000 Reader is located in the directory named \hp64700\bin 
by default, along with the PC Interface. This directory must be in the 
environment variable PATH for the HP 64000 Reader and PC Interface 
to operate properly. The PATH is usually defined in the 
"\autoexec.bat" file. 

The following examples assume that you have "\hp64000\bin" 
included in your PATH variable. If not, you must supply the 
directory name when executing the Reader program. 



Using the Reader 
from l\/IS-DOS 



The command name for the HP 64000 Reader is RHP64000.EXE. To 
execute the Reader from the command line, for example, enter: 



RHP64000 [-q] <filenaine> 



[-q] 



This option specifies the "quiet" mode, and 
suppresses the display of messages. 



<filename> This represents the name of the HP 64000 linker 

symbol file (file.L) for the absolute file to be loaded. 

The following command will create the files "TESTPROG.HPA"and 
"TESTPROG.HPS" 

RHP64000 TESTPROG.L 



Using the Reader 
from the PC Interface 



The PC Interface has a file format option under the "Memory Load" 
command. After you select HP64000 as the file format, the HP 64000 
Reader will operate on the file you specify. After this completes 
successfully, the PC Interface will accept the absolute and symbol files 
produced by the Reader. 

To use the Reader from the PC Interface: 

1. Start up the PC Interface. 

2. Select "Memory Load." The memory load menu will appear. 

3. Specify the file format as "HP64000." This will appear as the 
default file format. 

4. Specify the name of an HP 64000 hnker symbol file 
(TESTFILE.L for example). 
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Using the HP 64000 file that you specify (TESTFILE.L, for example), 
the PC Interface performs the following: 

■ It checks to see if two files with the same base name and 
extensions .HPS and .HPA already exist (for example, 
TESTFILE.HPS and TESTFILE.HPA). 

■ If TESTFILE.HPS and TESTFILE.HPA don' t exist, the HP 
64000 Reader produces them. The new absolute file, 
TESTFILE.HPA, is then loaded into the emulator. 

■ If TESTFILE.HPS and TESTFILE.HPA aheady exist but the 
create dates and times are earlier than the HP 64000 linker 
symbol file creation date/time, the HP 64000 Reader recreates 
them. The new absolute file, TESTFILE.HPA, is then loaded 
into the emulator. 

■ If TESTFILE.HPS and TESTFILE.HPA akeady exist but the 
dates and times are later than the creation date and time for 
the HP 64000 linker symbol file, the HP 64000 Reader will 
not recreate TESTFILE.HPA. The current absolute file, 
TESTFILE.HPA, is then loaded into the emulator. 



Date/time checking is only done within the PC Interface. When 
running the HP 64000 Reader at the MS-DOS command line prompt, 
the HP 64000 Reader will always update the absolute and symbol files. 



When the HP 64000 Reader operates on a file, a status message will be 
displayed indicating that it is reading an HP 64000 file. When the HP 
64000 Reader completes its processing, another message will be 
displayed indicating the absolute file is being loaded. 

The PC Interface executes the Reader with the "-q" (quiet) option by 
default. 
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If the ReadGr Won't if your program is very large, the PC Interface may run out of memory 
Run while attempting to create the database file. If this occurs, you will 

need to exit the PC Interface and execute the program at the MS-DOS 
command prompt to create the files that are downloaded to the 
emulator. 



Including RHP64000 You may wish to incorporate the "RHP64000" process as the last step 
in a MakG FIIg y^^^ "make file," as a step in your construction process, to eliminate 

the possibility of having to exit the PC Interface due to space 
limitations describe above. If the files with ".HP A" and ".HPS" 
extensions are not current, loading an HP 64000 file will automatically 
create them. 
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Index 



A absolute files 

<file>.hpa created by HP 64000 Reader, A-9 

Intel OMF86, A-1 

loading, 2-12 

NEC30, A-1 

NEC33, A-1 

storing, 5-20 
address expression 

breakpoints command, 5-10 

emulation commands, 5-4 

I/O command, 5-8 

load/dump commands, 5-6 

map command, 5-8 

memory commands, 5-5 

run Commands, 5-7 

step command, 2-25 
Address expression syntax, 5-4 
Address Mode, emulator configuration, 4-13 
Address Syntax, 5-2 
analysis begin, 2-35 
analysis display, 2-36 
analysis specification 

resetting the, 2-31 

trigger condition, 2-31 
analyzer 

features of, 1-4 
analyzer, using the, 2-31 
apapter 

PGA to QFP package of the uPD70236 and uPD70236, 1-3 
PLCC to QFP package of the uPD70136, 1-3 

ASCII symbol file (<file>.hps), A-9 

assemblers, 2-9 

assembling and linking the getting started sample program, 2-6 

B background, 1-6 

background monitor, 4-18 
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locating the, 4-18 

pin state, 3-12/3-13 
BNC connector, 5-17 
break command, 2-26 
breaking on analyzer trigger, 5-18 
breakpoint interrupt instruction 

software breakpoints (70136), 2-26 
Breakpoints command 

address expression, 5-10 
breaks 

software breakpoints, 2-26 
breaks on ROM writes, 4-6 
BRKXA and RETXA instructions, 1-8 
BS8/BS 16 input 

emulation memory, 4-15 

I/O accesses, 4-16, 5-10 

memory accesses, 5-9 

target memory, 4-16 
Bus size 

map command, 5-8 

C caution statements 

change page registers after software breakpoints defined, 2-27 
real-time dependent target system circuitry, 4-5 
software breakpoint cmds. while running user code, 2-26 
cautions 

filenames in the memory store command, 5-20 

installing the target system probe, 3-2 
characterization of memory, 2-9 
cim. Terminal Interface command, 2-27 
clock source 

extemal, 3-10, 4-4 

in-circuit, 4-4 

intemal, 3-10, 4-4 
CMB (coordinated measurement bus), 5-17 
CMB interaction, 4-8 
CMB signals, 5-17 

commands (PC Interface), selecting, 2-8 
configuration (emulator), 4-1 

loading, 4-21 

storing, 4-21 
coirfiguration options 
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20 bit address mode, 4-13 

DMA cycle in background (70236 only), 4-14 

FPU, 4-12 

wait count of DMA (70236/70236A only), 4-14 

accessing, 4-2 

AEX signal, 4-12 

background monitor location, 4-18 

breaks on ROM writes, 4-6 

bus sizing signal for emulation memory, 4-15 

bus sizing signal for target memory, 4-16 

CMB interaction, 4-8 

emulator clock source, 4-4 

foreground monitor address, 4-20 

in-circuit, 3-10 

lock READY signal, 4-10 

monitor type, 4-18 

read PGR registers, 4-11 

real-time mode, 4-5 

release bus by HOLD (70236/70236A only), 4-13 
segment:offset translation method, 4-17 
software breakpoints, 4-6 
target interrupts, 4-9 
target reset, 4-10 

trace DMA cycles (70236/70236A only), 4-13 

trace dummy HALT acknowledge (70236/70236A only), 4-15 

trace refresh cycles (70236/70236A only), 4-14 

configuration(hardware), instalhng the emulator, 2-2 

coordinated measurements 

break on analyzer trigger, 5-18 
definition, 5-17 

multiple emulator start/stop, 4-8 

run at /EXECUTE, 5-18 
coprocessor 

access emulation memory, 2-8, 3-10 
copy memory command, 2-39 
count, step command, 2-23 
cur segment method, 4-17 

D device table, emulator, 2-7 
displaying the trace, 2-36 
DMA 

extemal, 2-9 
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DMA (70136), 1-7 
DMA cycle 

background (70236/70236A only), 4-14 
dump command 

interpret address, 5-6 

E emulation analyzer, 1-4 
Emulation commands 

address expression, 5-4 
emulation memory 

access by uPD72291 coprocessor, 2-8, 3-10 

note on target accesses, 2-9 

size of, 2-8 
emulation monitor 

foreground or background, 1-6 
emulation RAM and ROM, 2-9 
emulator 

device table, 2-7 

feature list, 1-3 

purpose of, 1-1 

reset, 2-39 

running from target reset, 3-10/3-11 
status, 2-8 

supported microprocessor package, 1-3 
emulator configuration 

configuration options, 4-1 

loading, 4-21 

storing, 4-21 
Emulator features 

emulation memory, 1-4 
emulator probe 

installing, 3-2 
eram, memory characterization, 2-9 
erom, memory characterization, 2-9 
Evalution Chip, 1-8 
EXECUTE 

CMB signal, 5-17 

run at, 5-18 
executing programs, 2-25 
exiting the PC Interface, 2-40 
external clock source, 4-4 
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F file formats 

HP64000, A-12 
file formats, absolute, 2-12 
find data in memory, 2-25 
foreground, 1-6 
foreground monitor, 4-18 

locating the, 4-20 
FPU, emulator configuration, 4-12 

G getting started, 2-1 
prerequisites, 2-2 
global symbols, 2-15, 2-21 
grd, memory characterization, 2-9 
guarded memory accesses, 2-9 

H halt instructions, 4-18 
hardware installation, 2-2 
HP 64000 Reader, A-9 

using with PC Interface, A-12 
HP 64000 Reader command (RHP64000.EXE), A-12 
HP64000 file format, A-12 
HPTABLES environment variable, 2-7 

I I/O command 

address expression, 5-8 
IEEE-695 reader, A-2 
in-circuit configuration options, 3-10 
in-circuit emulation, 3-1 
installation 

hardware, 2-2 

software, 2-2 
internal clock source, 4-4 
internal I/O register access, 1-7 
internal I/O registers 

display, 1-7 

modify, 1-7 
interrupt 

from target system, 3-10 

from target system (70136), 1-7 

from target system (70236), 1-7 

while stepping, 1-7 
interrupts 

from target system, 4-9 
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L line numbers, 2-37 
linkers, 2-9 

linking the getting started sample program, 2-6 
load command 

interpret address, 5-6 
load map, 2-9 
loading absolute files, 2-12 
local symbols, 2-17, 2-29, A-3, A-11 
locating the foreground monitor, 4-20 
location address 

foreground monitor, 4-20 
locked, PC Interface exit option, 2-40 
logical run address, conversion from physical address, 4-17 

M make file, A-9 
Map command 

command expression, 5-8 
data bus size, 5-8 
address expression, 5-8 
mapping memory, 2-8 
max segment method, 4-17 
memory 

copy range, 2-39 

displaying in mnemonic format, 2-20 
modifying, 2-24 

reassignment of emulation memory blocks, 2-11 

searching for data, 2-25 
Memory commands 

address expression, 5-5 
memory memory 

access by coprocessor, 2-9 
memory, mapping, 2-8 
method, cur segment, 4-17 
method, max segment, 4-17 
method, min segment, 4-17 
microprocessor package, 1-3 
microprocessor socket 

for QFP package of uPD70136, 1-3 

for QFP package of uPD70236 and uPD70236, 1-3 
min segment method, 4-17 
monitor 

background, 4-18 
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foreground, 4-18 
monitor block, 4-20 
monitor program memory, size of, 2-8 

N NEC30 

reader, A-1 
NEC33 

reader, A-1 
NMI signal 

from target system, 4-9 
note 

PC relative addressing in disassemble list, 2-37 

step address not allowed over IM hex, 2-22 
note statements 

reassignment of emul. mem. blocks by mapper, 2-11 
notes 

absolute file names for stored memory, 5-20 

break to read page registers, 5-5, 5-10 

changing internal clock forces reset, 4-4 

CMB interaction enabled on execute command, 4-8 

coordinated measurements require background, monitor, 4-19 

date checking only in PC Interface, A-13 

displaying complete traces, 2-37 

line number symbols in memory and trace listings, A-4 

mapper terms deleted when monitor is relocated, 4-20 

mapping foreground monitor automatically, 4-19 

Reader only checks date/time within the PC Interface, A-7 

register command, 2-21 

software breakpoints not allowed in target ROM, 2-27 
software breakpoints only at opcode addresses, 2-27 
step not accepted, 2-22 

symbolic information is required in absolute file, A-2 
target accesses to emulation memory, 2-9 
use required options to include symbols, A-10 
using NEC33 Reader, A-8 

using terminal window to modify configuration, 4-3 
write to ROM analyzer status, 4-6 

O OMF86 

reader, A-1 

P PC Interface 

exiting the, 2-40 
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HP 64000 Reader, A-12 

selecting commands, 2-8 

starting the, 2-7 
physical run address, conversion to logical run address, 4-17 
pin protector 

target system probe (70236/70236A only), 3-3 
prerequisites for getting started, 2-2 

Q qualifiers, analyzer status (70136 emulator), 2-32 
qualifiers, analyzer status (70236 emulator), 2-33 

R RAM, mapping emulation or target, 2-9 
RDY signal from target, 4-10 
READY, CMB signal, 5-17 
real-time mode, 4-5 
register command, 2-21 
register commands, 1-5 
registers 

classes (70136 emulator), 5-11 

classes (70236 emulator), 5-12 

names (70136 emulator), 5-11 

names (70236 emulator), 5-12 
release bus by HOLD (70236/70236A only), 4-13 
relocatable files, 2-9 
RESET 

from target system, 4-10 
reset (emulator), 2-39 

running from target reset, 3-11 
RESET signal, 3-10 

resetting the analyzer specifications, 2-31 

respond to target HLDRQ during background operation 

(70236/70236A only), 4-13 

restrict to real-time runs 

permissible commands, 4-5 

target system dependency, 4-5 
ROM 

writes to, 2-9 
ROM, mapping emulation or target, 2-9 
run address, conversion from physical address, 4-17 
run at /EXECUTE, 5-18 
Run commands 

address expression, 5-7 
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run from target reset, 3-10^-11, 4-10 
running programs, 2-25 



S sample , 2-2 

sample program 

assembling, 2-6 

linking, 2-6 
searching for data in memory, 2-25 
selecting PC Interface commands, 2-8 
simple trigger, specifying, 2-31 
single step, 2-21 
software breakpoint 

70 1 36 breakpoint interrupt instruction, 4-7 

stepping, 1-8 
software breakpoints, 2-26, 4-6 

and NMI, 2-27 

clearing, 2-30 

defining (adding), 2-29 

displaying, 2-29 

ignored, 2-28 

setting, 2-30 
software installation, 2-2 
specifications 

analysis specification, 2-31 
starting the trace, 2-35 

status (analyzer) qualifiers, 70136 emulator, 2-32 

status (analyzer) qualifiers, 70236 emulator, 2-33 

status line, 2-8 

step, 2-21 

step count, 2-23 

Stepping 

at software breakpoint, 1-8 

BRKXA and RETXA instructions, 1-8 
stepping failed, 1-7/1-8 
symbols, 2-14 

.HPS file format, A-10 

global, 2-21 

local, 2-29, A-9 
system command 

exit, 2-40 
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T target reset 

running from, 3-11 
target reset, running from, 3-10 
target system 

dependency on executing code, 4-5 

interface, 3-14, 3-17 
target system probe 

cautions for installation, 3-2 

pin protector (70236/70236A only), 3-3 
target system RAM and ROM, 2-9 
trace 

description of listing, 2-37 

displaying the, 2-36 

starting the, 2-35 
Trace Ust 

extended address mode, 2-36 

normal address mode, 2-36 

PC relative addressing in disassemble hst, 1-8 
trace signals, 2-31 

tracing dummy HALT acknowledge (70236/70236A only), 4-15 

tracing internal DMA cycles (70236/70236A only), 4-13 

tracing refresh cycles (70236/70236A only), 4-14 

tram, memory characterization, 2-9 

TRIGl, TRIG2 internal signals, 5-18 

trigger 

breaking into monitor on, 5-18 

specifying a simple, 2-31 
trigger condition, 2-31 
TRIGGER, CMB signal, 5-17 
trom, memory characterization, 2-9 

U undefined software breakpoint, 2-28, 4-7 
unlocked, PC Interface exit option, 2-40 
using the HP 64000 file reader, A-9 

W wait count of DMA (70236/70236A only), 4-14 

wait states, allowing the target system to insert, 4-10 

Z zoom, window, 2-16, 2-20 
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